Security, explained clearly.
The protocols, access controls, and operational boundaries behind Rest Workspace—so your team can assess the service with accurate information.
Encryption and the protocols we use
| Protocol or control | What it protects | Boundary |
|---|---|---|
| HTTPS / TLS and WSS | Hosted web/API requests and realtime signaling in transit. | Encryption terminates at the authorized service infrastructure. Negotiated TLS versions depend on the endpoint and client; this page does not promise TLS 1.3 on every connection. |
| WebRTC DTLS-SRTP | Audio, video, and shared-screen media transport. | SFU mode terminates media transport at Cloudflare. It is not participant-only end-to-end encryption. |
| Provider storage encryption | Storage managed by the relevant Cloudflare/Supabase service. | The application and authorized operators can process content. This is not a user-held encryption key for every record. |
| AES-256-GCM | Password-encrypted exports; the optional central office-record copy when enabled. | Exports use a browser-derived password key. Central-copy keys are managed server-side. This extra layer does not cover every live record or R2 file. |
| PBKDF2-HMAC-SHA-256 | Derives encrypted-export keys from a password, using a random salt and 600,000 iterations. | Password strength and safe storage of the export remain important. Lost export passwords are not recoverable by Rest. |
| ES256 / RS256 JWT verification | Server validation of supported Supabase authentication tokens against the project’s signing keys. | Signature, issuer, audience, expiry, identity, and session state are checked; token contents alone do not grant company access. |
| TOTP / AAL2 | Authenticator-based second-factor verification for platform/company admin actions. | Employees currently use email OTP without a mandatory second factor. Email OTP alone is not described as MFA. |
| HMAC and SHA-256 | Signed requests between application services and integrity checks for content snapshots. | A digest detects a mismatch; it does not encrypt content or create an immutable audit system. |
The use of established protocols describes technical choices, not certification. Read the provider descriptions of Cloudflare Realtime SFU and Supabase platform security for their own service boundaries.
Account security and administrative access
Managed-office access is tied to an eligible email address and company membership or invitation. Sign-in uses a one-time email code. Platform and company admins must complete TOTP verification before admin-authorized access; server checks enforce the required authentication assurance level.
Supabase authentication tokens are placed in HttpOnly cookies with Secure on hosted HTTPS and SameSite=Lax. The server verifies signed tokens and checks session validity. Office credentials are separate from those cookies and are persisted in browser storage to support office re-entry. Users should sign out and clear site data on shared devices.
Turnstile and server-side limits help reduce automated sign-in and code-guessing abuse. Logout, account controls, and membership revocation invalidate relevant access. Email delivery, mailbox security, device security, and authenticator recovery also affect account protection.
Company, room, and file authorization
Company membership and roles are checked server-side. Realtime state is separated by office in Durable Objects, and media subscriptions are checked against current membership and room. Direct-message attachments use account/recipient access checks rather than a public download link alone.
Where the Postgres platform backend is configured, the implementation uses a private application schema, restricted application roles, transaction-scoped verified identity, and row-level policies. A deployment using another configured backend must not be described as protected by Postgres RLS merely because that code exists.
Administrative exports and recovery paths can include chat and direct messages. Room locks and “private” messages govern normal application access; they are not a promise of cryptographic secrecy from authorized platform operation. The Privacy Policy explains this distinction.
Browser and request protections
The hosted application implements a nonce-based Content Security Policy, blocks untrusted inline script handlers, applies same-origin/CSRF checks, bounds request bodies, and uses private/no-store API headers. Authentication and company roles are verified on the server rather than accepted from a submitted role or email field.
Attachments are downloaded through an authorization route with an attachment disposition and an application/octet-stream response. A permitted file is not guaranteed to be malware-free: a dedicated antivirus-scanning service is not currently claimed. Only open files from people you trust and use your organization’s device protections.
Server credentials for Supabase, SFU, TURN, and the application gateway are not intended for delivery to the browser. Temporary media credentials and office session tokens are different credentials needed by clients. Browser extensions, compromised devices, and stolen sessions remain outside what transport encryption alone can prevent.
Live media, recording, and workplace visibility
Cloudflare SFU/TURN supports live media. The application also contains a mesh mode, so connectivity and IP-exposure properties depend on the deployed mode. TURN is a relay for connectivity, not a guarantee of anonymity.
Calls are not automatically recorded by Rest. Company admins can start room-audio recording, with a room indicator and chat notices; the browser produces an audio file that can be uploaded to room chat. Participants and employers must meet the notice/consent requirements applicable to them. External recording cannot be prevented in every case.
Presence and availability can be visible to colleagues. Estimated work-time reports are available to the account holder and authorized company admins. Read the recording and presence explanations before using Rest in your organization.
Retention, backups, and recovery limits
Managed-office chat defaults to 30 days, with configurable retention. Internal office snapshots have integrity checks and can include direct messages, boards, profiles, room settings, and attachment metadata. File bytes in R2 need their own backup/recovery arrangement. Exported files and downloaded recordings can remain with recipients after active records expire.
Optional central replication uses AES-256-GCM, while password-encrypted exports use browser-side encryption. These functions depend on configuration and successful execution; neither an available backup button nor an internal restore test proves full disaster recovery for a particular deployment.
We do not publish a contractual RPO/RTO or guaranteed availability under this page. Review the retention table and confirm a company-specific recovery arrangement before relying on Rest as the only copy of important business records.
Standards, certifications, and assurance status
Rest does not currently claim its own SOC 2 examination, ISO 27001 certification, completed independent penetration test, or blanket GDPR, HIPAA, or PCI DSS compliance. Cloudflare and Supabase publish assurance information for their own service scopes. Using those services does not transfer their certification or make an application independently audited.
Internal automated checks cover authentication rejection, admin MFA, company isolation, private-attachment access, revocation, and backup integrity. Those checks support engineering review; they do not prove that every vulnerability has been found or that every production configuration has been verified. Production browser/network testing and independent assessment are separate evidence.
We do not claim enterprise SAML/OIDC SSO, mandatory MFA for every employee, immutable audit storage, a staffed 24/7 security operations center, or complete account-loss recovery as universally available controls. Ask us for current deployment-specific evidence and any contractual commitments your company requires.
Security responsibilities for your team
- Protect the mailbox used for sign-in with your email provider’s MFA; never share one-time codes or authenticator setup secrets.
- Invite the intended work email, grant admin rights only when needed, and revoke access promptly when someone leaves.
- Use supported, updated browsers and managed devices. Review extensions and screen-sharing scope.
- Explain presence reporting and recording to employees and guests, and obtain any required permissions.
- Agree retention and backups; keep independent copies of important files and protect exported content.
- Confirm contractual, regional, and regulatory requirements before sharing sensitive or regulated data.
Security questions and answers
Is my workspace data encrypted?
Connections to the hosted service use HTTPS/TLS. Audio, video, and screen sharing use WebRTC transport encryption (DTLS-SRTP). Stored data is protected by the relevant cloud storage service. An optional central office copy uses application-level AES-256-GCM when configured. These protections do not make Rest end-to-end encrypted: authorized servers and service providers can process content.
Which security standards and controls does Rest use?
Rest uses established protocols and controls: TLS, WebRTC DTLS-SRTP, signed authentication tokens, email one-time codes, TOTP multi-factor authentication for admins, server-side membership and role checks, and browser security controls. AES-256-GCM protects password-encrypted exports and the optional central copy. These are technical controls, not an independent certification of Rest.
Can another company see our office or private messages?
Managed offices check company membership and permissions on the server. Realtime state is separated per office, media subscriptions are checked against room membership, and direct-message attachments are restricted to the intended accounts. Private messages are not end-to-end encrypted; authorized platform operations and administrative backups can include them.
How are accounts protected?
Sign-in uses an email one-time code and server-side session validation. Platform and company admins must also verify a TOTP authenticator code. Ordinary employees are not currently required to use a second factor. Cloudflare Turnstile and request limits help protect sign-in against automated abuse.
Are conversations recorded?
Live calls are not automatically recorded by Rest. A company admin can explicitly start an audio recording of a room. A recording indicator and chat notices are shown; the admin’s browser mixes the audio it receives and uploads the completed recording to room chat. Other participants can also use external recording tools. Your organization must explain recording practices and obtain any required permission.
Can my company see my presence or work time?
Workspace participants can see relevant profile and presence information. Company admins and the account holder can access presence-derived work-time summaries. These summaries are retained for 90 days and are estimates of connection and availability, not a reliable measure of productivity or hours actually worked.
How long are messages and files kept?
Managed-office chat defaults to 30 days and can be configured from 1 to 365 days. Attachments, including uploaded audio recordings, receive an expiry based on the chat setting when uploaded. Cleanup may run later, and backups or downloaded copies can outlive active records. The Privacy Policy explains each category and its limits.
Does Rest have SOC 2 or ISO 27001 certification?
Rest does not currently claim an independent SOC 2 examination, ISO 27001 certification, or completed independent penetration test. Certifications held by infrastructure providers apply to their stated service scope and are not automatically certifications of Rest. We also do not claim blanket GDPR, HIPAA, or PCI DSS compliance.
Where can I read the full privacy and security details?
Read the Security page for encryption boundaries, authentication, access controls, and current assurance limits. The Privacy Policy explains data categories, providers, cookies, retention, recording, administrator access, and how to request access, correction, or deletion. Contact santus@restworkspace.com with privacy or security questions.
Report a concern or request details
Email santus@restworkspace.com for suspected account compromise, a vulnerability, or a company security questionnaire. Include affected URLs, a time/time zone, and minimal sanitized reproduction details. Never email an OTP, password, service key, or another company’s confidential content.
A report is not authorization to access other users’ data, conduct disruptive tests, or publish private information. We can coordinate a permitted testing scope. This contact does not promise immediate response or a staffed on-call service. See the Privacy Policy for incident information handling.