Freesbe
Book a demoStart free

Security

Your team's conversations stay yours.

Freesbe is 100% serverless and runs at the edge of one of the world's largest networks, with encryption at every step. Here's how we keep your messages, files and calls safe.

ISO/IEC 27001 certified
100%
Serverless. No servers for anyone to break into or forget to patch.
330+
Cities on the global network Freesbe runs on, close to every team.
256-bit
Encryption for your data at rest, your local cache and your secrets.
24/7
Always-on protection against DDoS attacks and malicious traffic.

Built on the edge

  • 100% serverlessFreesbe has no servers of its own: no machines to break into, no operating systems to patch, nothing left running and forgotten. The app runs in isolated sandboxes on infrastructure that is patched for us, around the clock.
  • Runs close to your teamFreesbe runs on Cloudflare's global network, one of the largest in the world, with data centers in more than 330 cities. The app runs in the data center nearest you, so it stays fast wherever your team works.
  • Always-on DDoS protectionThe same network that protects millions of websites stands in front of Freesbe around the clock, absorbing attacks before they ever reach the app.
  • Encrypted everywhere it travelsEvery page, message, file and live update moves over modern TLS encryption. Nothing is ever sent in plain text.
  • Encrypted wherever it's storedMessages, files and recordings are encrypted at rest with 256-bit AES. Integration secrets and phone line credentials get a second layer of encryption, each under its own key.
  • Passwords we can't readPasswords and sign-in tokens are stored only as one-way hashes. Not even our team can see them.

Redundant and always available

  • No single point of failureFreesbe runs in every data center on the network at once. If one goes offline, traffic moves to the next nearest one automatically, without anyone lifting a finger.
  • Files stored redundantlyEvery file and recording is copied across multiple devices and designed for 99.999999999% durability, so a failed disk never means lost data.
  • Point-in-time recoveryOur database keeps a continuous history, so it can be restored to any minute in the last 30 days if something ever goes wrong.
  • Zero-downtime updatesNew versions roll out across the network in seconds, with no maintenance windows and no interruption to your calls or chats.

Security best practices

  • Least privilegePeople, integrations and our own services get only the access they need. Production secrets live in managed secret storage, never in code.
  • Reviewed, tested changesEvery change to Freesbe goes through code review and an automated suite of type checks, tests and builds before it can ship.
  • Privacy by designWe collect only what's needed to run the service, never sell your data and show no ads. We list every provider that processes your data in our privacy policy.
  • Choose where your data livesEach workspace picks where its data is stored: the European Union or the United States, where messages, files, recordings, transcripts and backups never leave the region, or Asia-Pacific or Oceania, close to the team.
  • Built for GDPRWe process workspace data only on your behalf and honor requests to access, export or delete personal data, so you can meet your obligations under GDPR.

Data residencyAudit log

Workspace settings, General: Data region, showing European Union and that the data stays in the EU

On your devices

  • Encrypted local cacheFreesbe opens instantly because recent messages are kept on your device, sealed with 256-bit encryption under a key unique to you and your workspace. The key never touches the disk, so the cache is unreadable without signing in.
  • Wiped the moment access endsSign out, or lose access to a workspace, and its cache is erased. Deactivate someone and their key is replaced, so anything left on their laptop is useless.
  • Instant offboardingDeactivating a member cuts off their access everywhere at once, on every device. Sessions expire on their own after 30 days.

Sign-in and access

  • Single sign-onSign in with Google or Microsoft. Accounts are only linked when the provider has verified the email address.
  • Required SSOAdmins can require everyone in a workspace to sign in through Google, Microsoft or either. Anyone who signed in another way is turned away. Included with Corporate and Enterprise.
  • PasskeysSkip passwords entirely with Face ID, Touch ID, Windows Hello or a security key. Passkeys can't be phished or reused.
  • Required multi-factor sign-inOwners and admins can require a second factor for everyone in the workspace: a passkey, an authenticator app or an emailed code, and choose how often people verify again. Included with every paid plan.
  • One-time email codesCodes expire in 10 minutes and lock after five wrong guesses. Repeated sign-in attempts are throttled automatically.
  • Roles and guestsOwners, admins, members and guests each see only what their role needs. Guests see only the channels they were invited to, and you can require approval before any guest gets in.

Single sign-onMulti-factor authentication

Workspace settings, Single sign-on: Members must sign in with Google, Microsoft, or either

Calls and recordings

  • Encrypted callsEvery call, video and screen share is encrypted from your device to the network, using the same standard built into every modern browser.
  • Nobody is recorded silentlyWhen a recording starts, everyone in the call is told and hears a tone, a recording badge stays on screen, and anyone in the call can stop it.
  • Waiting room for guestsGuests joining a meeting wait in a lobby until someone from your workspace lets them in, so a forwarded link never lets a stranger walk into the call.
  • Recording controls for adminsAdmins can turn recording off for the whole workspace, or, on Corporate and Enterprise, have recordings deleted automatically after 30, 90 or 365 days.
Workspace settings, Recordings: Who can start and stop recordings, set to Whoever started it, hosts and co-hosts

Hardened by design

  • Locked-down browser securityFreesbe tells your browser to refuse any script that doesn't come from us, and to never load the app inside another site. That shuts the door on the most common web attacks.
  • Uploaded files can't misbehaveFiles are only available to signed-in members and are opened in a sandbox, so a malicious upload can't run inside the app.
  • Signed webhooksEvery outgoing webhook is signed and time-stamped, so your systems can prove it came from Freesbe. Webhooks can never be aimed at private networks.
  • Link previews that say nothing privateWhen an invite or meeting link is shared in another app, its preview shows only your workspace's name and logo. Never who sent it, which channels, or when the meeting is.
  • Built-in abuse limitsDaily limits on sign-in codes and invites keep Freesbe from ever being used to flood someone's inbox.

Security and compliance in the product

Independently certified

Freesbe is run under an information security management system certified to ISO/IEC 27001, the international standard for information security, with a scope covering our cloud communications platforms. Independent auditors check how we manage risk, access, changes and incidents, and re-audit us every year.

Need a copy of our certificate for a vendor review? Email sales@freesbe.net.

On the roadmap

These aren't available yet. We list them so you can plan, not as something you can rely on today.

Planned

SCIM and directory sync

Add and remove people automatically from Microsoft Entra ID (Azure AD), Okta and Google Workspace.

Planned

SOC 2 Type II

An independent audit of our controls. We'll publish here when it's done.

To be clear

  • Freesbe is not end-to-end encrypted. Messages and files are encrypted in transit and at rest, and our service can read them to deliver, search and index them for your workspace. Call media is encrypted between each device and Cloudflare's media servers, which forward it to the other people in the call.
  • We're certified to ISO/IEC 27001. SOC 2 is on the roadmap and not done yet. Our infrastructure provider, Cloudflare, publishes its own certifications.
  • We don't sell your data or use it for ads.

Read our privacy policy for what we collect and who processes it, and our terms. Admins can find setup steps for SSO, multi-factor authentication, data residency, the audit log, guests and recordings in the docs.

Report a security issue

If you think you've found a vulnerability in Freesbe, email security@freesbe.net with what you found and how to reproduce it. We'll acknowledge your report within three business days and keep you updated while we fix it.

While you look, please:

  • Only test with accounts and workspaces you own, and don't access other people's data.
  • Don't run denial-of-service tests, spam, or social engineering against our team or customers.
  • Give us a reasonable time to fix the issue before you share it publicly.

If you act in good faith and follow these guidelines, we won't take legal action against you. Our contact details are also in security.txt.

Questions about security for your company's review? Email sales@freesbe.net. Freesbe is made by Freesbe, Inc.

Try all of it free with up to 10 people.

No card, no time limit. Invite your team and see what sticks.

Start freeBook a demo