Security
How the office keeps your words and your data.
Every sentence on this page describes what the code does today. Each number comes from the place that enforces it.
We claim no certification here. If something is not on this page, we have not built it.
Enforced by Database
The database keeps offices apart.
Every record of your office names the office it belongs to, and row-level security hides it from anyone who is not an active member. The database refuses, not only the app.
Enforced by World server
Doors and floors are checked on every step.
The server that moves everyone checks which office a floor belongs to, who may walk into a locked or full room, and keeps a guest inside the one room their link opens.
Enforced by Stripe
Your card never comes here.
You pay on Stripe's own page. We keep references to the customer and the subscription, never a card number.
Where your data lives
What leaves a room, and where it goes.
Postgres holds the office and its records. LiveKit carries voices in the moment. Stripe holds the money.
What each line carries
- Your office → PostgresEvery record names your office
- The meeting → LiveKitLive voice and video, never stored
- The meeting → PostgresA transcript, only when someone asks
- Billing → StripeThe card stays with Stripe
- Billing → PostgresReferences to the subscription, never the card
Your office is yours
One office cannot read another.
Your office shares a database with other offices, and the database itself keeps them apart.
Every record names your office
Members, rooms, desks, chat, transcripts, billing — each record carries the office it belongs to. Nothing is filed without it.
Enforced by Database
Row-level security on every table
A signed-in person reads only the rows of offices they are an active member of. A request for another office's rows comes back empty, however it is made — through the app or straight to the database.
Enforced by Database
A floor plan belongs to one office
When you join, the server checks the floor is your office's own. A map cannot be pointed at another office's floor plan: the database refuses the change.
Enforced by World server
Nobody is seated by MicroHabitat
A customer office's members come only from its own invites. The job that seats MicroHabitat's own staff never touches a customer office.
Enforced by Database
Who gets in
Invites, roles and guests.
Three ways in, each one bounded.
An invite is for one verified address
Only an account signed in with the exact email the invite was sent to can accept it, and only once that email is verified. A link expires after 14 days.
Enforced by Database
Only admins invite, and not without limit
Only an admin of the office can send an invite. One account can send at most 300 a day across every office it runs. Invites come from hello@virtualoffice.world, with the person who sent it as the reply address.
Enforced by Our server
The owner stays the owner
Nobody can remove the office's owner or its last admin. A co-admin cannot demote or ban anyone by writing to the database directly: in a customer office, roles and seats change only through the app.
Enforced by Database
Removing someone takes effect now
Their connection to the office is dropped at once and their seat leaves your bill. Their record keeps its name, so an invite later brings back the same seat.
Enforced by Our server
A guest stays in one room
A guest link opens one meeting room. The guest cannot step outside that room, and a member must check them in before they can talk unless the link says otherwise. The link lasts at most 14 days, can be limited to a number of visits and can be revoked. When it ends, the guest's connection is dropped.
Enforced by World server
Conversations
Nothing is recorded unless someone asks.
Voices travel live. Words are kept only when a meeting asks for a transcript, and only the people who were there can read them.
Live, through a media server we run
Audio, video and screen sharing go through LiveKit on servers we operate. Recording is not switched on in the product. Your microphone and camera are off when you arrive.
Enforced by World server
A transcript exists only on request
A meeting is written down only when someone in it asks. Everyone in the room is then included, and each person can leave their own words out with one tap. A guest's words are never written down.
Enforced by World server
Attendees only — not even an admin
Only the people who were in the meeting can read its transcript and its notes. An office admin who was not there cannot. The rule is a database policy with no exception.
Enforced by Database
Notes written by Claude
A summary and a list of what each person said they would do are written from the transcript by Anthropic's Claude. Anyone who was there can download the words and the notes as a text file.
Enforced by Our server
Deleted after 90 days
The words and the notes are deleted 90 days after the meeting ends. A record stays that the meeting happened and who was in it.
Enforced by Database
Speech to text, without keeping the sound
In Chrome and Edge on a computer, the browser's own speech recognition is used. Elsewhere, short clips of your own microphone go to our server, which passes them to an OpenAI transcription model and keeps nothing.
Enforced by Our server
Payments
Stripe holds the card. We hold references.
Money never passes through this site.
You pay on Stripe's page
Checkout and the billing portal are Stripe's own. We keep your office's Stripe customer and subscription references, the plan, the number of seats and when the period ends — never a card number.
Enforced by Stripe
Every message from Stripe is checked
A webhook's signature is verified on the raw body before anything is read. Each event is recorded by its id and handled once. The subscription's state is read back from Stripe, never taken from the message itself.
Enforced by Our server
Only an admin touches billing
Only an admin of the office can open checkout or the billing portal.
Enforced by Our server
Seats follow your members
Your bill counts active members; guests are free. A check every 15 minutes corrects any count that drifts, and a seat count changed anywhere else is put back.
Enforced by Database
30 days to start, 14 days of grace
A new office opens with a 30-day trial and no card. If a payment fails, the office stays open for 14 days, then nobody can enter until it goes through.
Enforced by Database
Sign-in
There is no password.
Accounts are held by Supabase Auth.
A code to your email, or Google, Microsoft or GitHub
You sign in with a one-time code sent to your email address, or with your Google, Microsoft or GitHub account. There is no password, so there is none to reuse or leak.
Enforced by Supabase Auth
Connecting GitHub carries a signed ticket
Connecting GitHub to your office starts with a signed state naming your office, your account and the site you started on. It is good for 10 minutes, the return is refused for any other account, and your membership is checked again before anything is linked.
Enforced by Our server
What we store and where
Each kind of data, where it sits, who can read it.
| Data | Where it is | Who can read it |
|---|---|---|
| Your email address and name | Supabase Auth and our account records | You. The members of your office see your name. |
| Your office: members and roles, rooms, desks, chat | The office database, under row-level security | Active members of that office only |
| Live voice, video and screen share | LiveKit, for the moment it is spoken | The people near you or in your room. Nothing is stored. |
| Meeting transcripts and notes | The office database | The people who were in the meeting. Deleted after 90 days. |
| Short microphone clips for speech to text (Firefox, Safari, phones) | Passed to an OpenAI transcription model through Vercel's AI Gateway | Nobody afterwards: the clip is answered and dropped |
| Billing: customer and subscription references, plan, seats, period end | Stripe, with references in the office database | Your office's admins, through Stripe's portal |
| Your card | Stripe | Not us. It is entered on Stripe's page and stays there. |
Data you can take
A meeting's words, as a file.
Anyone who was in a meeting can download its transcript and its notes as a text file, from the meeting itself or from their archive afterwards. There is no other export today.
Report a problem
Tell us what you found.
If something on this page is not true of the product, or you found a way in that should not exist, write to us. We reply by email.
What we do with your information is in the privacy policy.
See the office for yourself.
30 days free. No card needed. Everything on this page applies from the first minute.
