Security
We would rather hear about a problem from you than from an incident. If you believe you have found a security or privacy issue in 2GEDAPPS, please tell us directly.
Report a security issue
Email security@2gedapps.com with the steps to reproduce, what you were able to reach, and the time it happened. Please do not include other people's personal information in your report.
Security reports are handled separately from ordinary feedback and are escalated on receipt. For harmful content or someone's behaviour, use the report option inside the app instead — see Safety.
What we ask
- Use your own test accounts and synthetic data.
- Do not access, change or keep other people's data.
- No denial-of-service, spam or social engineering.
- Give us a reasonable chance to fix the issue before publishing.
What we do
- Acknowledge your report and tell you what we found.
- Prioritise anything that crosses an organization boundary.
- Fix, retest, and record the change.
- Tell affected customers when that is the right thing to do.
In place today
- Authorization is enforced in the database with row-level security, not in the interface.
- Each organization is isolated: knowing another organization's identifiers does not grant access.
- Privileged actions run through server-side checks and write audit records that customers cannot edit or delete.
- Protected files are served through short-lived private links rather than public URLs.
- Removing someone from an organization ends their access to its chats, spaces, files, tasks and directory without waiting for them to sign out.
Not in place yet
We would rather be accurate than impressive. These are genuinely unavailable today:
- Two-step verification, passkeys and biometric unlock are not implemented.
- Server-enforced session timeout is a policy setting only; it is not enforced by the server today.
- Malware scanning of uploaded files is not configured.
- Push notification delivery, 2GED Meet, meeting recording and single sign-on are not configured.
- We make no compliance certification claims of any kind.
No system is perfectly secure. We describe what has been verified under testing, and we do not claim certification, guaranteed safety or immunity from attack.