Your workspace holds your team’s mail, files, conversations and plans. This page explains, in plain terms, how we keep them safe, what you control, and who to tell if you find a problem.
Every workspace is separate from every other one, with its own data and its own search. Each request is checked against the workspace it belongs to, so people in one workspace cannot see or reach another.
You see what is yours, and what has been shared with you.
| What | Who can see it |
|---|---|
| Only the person whose mailbox it is can open its mail or send from it. Administrators can set up and change a mailbox’s settings and rules, which its owner can see, but cannot open its mail. | |
| Work items | The person who created the item, the people and groups it is assigned to, and, when a project is opened to its members, everyone who can open that project. Administrators step in only when an item has no active owner left. |
| Notes | Private to their author until shared with people or the whole workspace. |
| Calendar events | Private events show other people only that the time is taken. |
| Files | Personal files are yours. Group folders follow group membership. |
Administrators manage people, groups, settings and apps. They do not automatically read everyone’s mail or work.
You sign in with your workspace name, your login and a password. Passwords are protected so that nobody, including us, can read them back. Repeated wrong attempts are slowed down, and the sign-in never reveals whether the login or the password was wrong.
A session ends after 24 hours, and changing your password signs you out everywhere. When someone leaves, an administrator deactivates their account and their sessions and access end at once. If you forget your password, an administrator sets a new one.
Phones, calendar apps and scripts use access tokens instead of your password. A token is shown once, works only in its own workspace, and can be limited to what it needs, for example contacts only. It can be given an expiry, and its owner or an administrator can switch it off at any time. A token never has more rights than the person it belongs to, and it cannot create other tokens.
Every app is signed by its publisher with a certificate issued through groupforce, so unsigned apps cannot be installed and nobody can pose as another publisher. Before an app is installed, an administrator sees what it adds and what it may read, change and run, and an app can do only what it declared.
An app that asks to reach your work items or projects reaches none of them until an administrator chooses how far. The parts of an app that run in the browser are kept in a restricted area with no access to your session or your other data. Code that runs on our servers runs in its own isolated environment, without network access and under strict limits. When you build apps in App Studio, the key that signs them is made in your browser and is never sent to us.
How administrators manage apps is described in Installing and updating apps.
Connections to groupforce are encrypted. The mailbox passwords you connect, and other secrets we need to use on your behalf, are stored encrypted. Passwords and share-link passwords are stored in a form that cannot be turned back into the original.
Email from outside is cleaned before it is shown, so a message cannot run code in your workspace. We connect only to mail servers on the public internet, and we check their certificates.
A share link gives a file to someone without an account. Each link is random and hard to guess, can expire, can be protected with a password, can allow reading only or changes too, and can be switched off at any time. Wrong password attempts are limited. Anyone who holds the link has access, so share it with care.
Every workspace is backed up once a week. Backups are encrypted before they leave our servers and are kept in a separate place, so losing a server does not lose your data. If something has to be restored, our team does it on request. Up to a week of changes can be lost in a restore, and a backup is kept for eight weeks, so data you delete stays in older backups until they expire.
Plans with the backup add-on also get daily snapshots, kept for up to six months. Business includes the first 100 GB of backup.
When you delete a file or folder in Documents, it moves to Deleted items and can be restored with its history for 30 days on Basic, 60 on Pro and 120 on Business. After that it is removed for good. Deleted notes are not kept: they cannot be recovered.
When a subscription ends, the workspace is not deleted straight away: its data is kept for at least 30 days after the paid period ends, so you can come back.
Changes to records are kept in a history you can read on the record, within the same rules about who can see it. Administrators can see each person’s sign-in history: when, from where and whether it worked.
You pay from your own wallet. We never hold your keys and never send anything: we only watch the network and count an order as paid once the network confirms it. Pay exactly the amount shown; a payment of another amount, or in another token, does not count.
Write to [email protected] with what you found, where, how to reproduce it, what you think it allows and which workspace or address is affected. To encrypt the report, use our PGP key (fingerprint A61C 4D6F 9630 21D6 E6D7 C18D 3962 5A31 8B31 31A7). The same details for tools are in security.txt. Please give us a reasonable time to fix a problem before you tell anyone else.
In scope: groupforce.org, shop.groupforce.org, console.groupforce.org, ops.groupforce.org, and the workspace hosts (one per workspace, <workspace>.groupforce.org).
Out of scope: other customers’ workspaces and data (test only against an account you own), denial-of-service and volume attacks, spam or social engineering of our staff, physical attacks, third-party services, and findings that need an already compromised device. Please do not access other people’s data while testing.
If you follow this policy and act in good faith, meaning that you do not read, change or keep more data than needed to show the problem, do not disrupt the service, and give us time to respond, we will not start legal action against you and will not ask the authorities to.