Gate one
Nothing to forget
Every query runs through a client that already knows which company is asking. Ordinary code cannot leave the filter out, because it never writes one.
Your company’s conversations, at your own address.
Channels, direct messages, calls and search — with every company’s data held apart at the database itself, not just in the code that queries it.
Free to start · No card required · Live in about a minute
Built for teams who keep things to themselves
AgenciesClinicsLaw firmsStudiosConsultancies
Separation you can actually point at.
Most multi-tenant products keep companies apart with a WHERE clause and good intentions. One forgotten filter is all it takes. Here the boundary is enforced twice — once in the data layer, and again by the database itself.
Gate two
Enforced in Postgres
Row-level security applies to every statement, including the ad-hoc query written at 2am that never went near the data layer. It holds whatever the code does.
Proven, not promised
Tested on every change
A dedicated suite tries to read across the boundary from every angle — raw SQL, search, sockets — and blocks the build if any of it succeeds.
Everything a working day needs.
Familiar where it should be, and careful where it counts.
Channels & threads
Public rooms anyone can join, private ones that never appear to people outside them, and threads that keep the main view readable.
Direct messages
Private to the people in them. No role opens a conversation it is not part of — not Admin, not even the workspace Owner.
Calls & screen share
Start a call from any channel or conversation. A call in a private channel is exactly as private as the channel.
Search that respects access
Results only ever come from rooms you can already read, because search runs inside the same boundary as everything else.
Presence & read state
Typing indicators, unread counts and mention badges. DMs show when they have been read; channels do not publish who read what.
Audit from day one
Role changes, deletions and oversight reads are appended to a log the application cannot rewrite.
Start free. Move up when it earns it.
Free covers 90 days of history and one-to-one calls. Paid plans add unlimited history, group calls with screen sharing, AI summaries and SSO.