Security

oorja is built with your privacy in mind, ensuring content and communications stay confidential among collaborating users.

Note from Our Team

We aim to keep things clear and straightforward. If you have any questions about how we operate, your privacy, or anything else, we're happy to help.

Email us at hello@oorja.io

Encryption in transit and at restAll content-data is encrypted in transit and rest. By content-data we mean chat-messages, diagrams, code, terminal-stream-text or any data created among room-participants using the collaborative apps.
End-to-end encryptionContent-data is synced among participants using secure transports (TLS) when they are online in the space. Content-data is also end-to-end encrypted using 128-bit AES-GCM: oorja servers, and even trusted certificate authorities cannot read into it without the secret key (kept in room's secret link's fragment. The application does not send the secret key to any server or third party).
It is the responsibility of space-participants to share room-links with trusted peers over trusted channels.
Content storageCollaborative apps store content-data on users personal devices (browser storage) encrypted with room-key.
To facilitate collaboration in scenarios where participants are online at different times, content-data is also uploaded to the server as an encrypted snapshot and synced to the participants when they come back online.
External APIsSome apps may involve use of external APIs (eg. Sparkchat configured with OpenAI, or code-run request in Nanocode), in such cases some relevant content will be sent to external apis from the client-app.
Data sent to external APIs uses TLS (Be sure to read the privacy policy of the external API provider)
Media communicationsMedia comms (camera, mic, screen) are end to end encrypted using the room key.
Secure keychainWe provide a secure keychain for users to store private information like space keys. This keychain is protected using strong 256-bit AES-GCM encryption, with a key created from the user's password (or a standard key by default). The password never leaves your device, and all keychain changes are made on-device. If you lose or forget your password, you won't be able to access your keychain. The encrypted version of the keychain syncs to our server, enabling access from multiple devices while maintaining security.
Your keychain stores space access keys and is encrypted with a standard key by default.
This works well for most people - we never use this key to access your content and everything stays opaque to our servers.

You can set your own password for more control over encryption (in settings).
Security vulnerability reports
Contact hello@oorja.io. Note that we do not have a bug bounty program.