100% serverless
Freesbe has no servers of its own: no machines to break into, no operating systems to patch, nothing left running and forgotten. The app runs in isolated sandboxes on infrastructure that is patched for us, around the clock.
Security
Your team's conversations stay yours.
Freesbe is 100% serverless and runs at the edge of one of the world's largest networks, with encryption at every step. Here's how we keep your messages, files and calls safe.
ISO/IEC 27001 certified- 100%
- Serverless. No servers for anyone to break into or forget to patch.
- 330+
- Cities on the global network Freesbe runs on, close to every team.
- 256-bit
- Encryption for your data at rest, your local cache and your secrets.
- 24/7
- Always-on protection against DDoS attacks and malicious traffic.
Built on the edge
Runs close to your team
Freesbe runs on Cloudflare's global network, one of the largest in the world, with data centers in more than 330 cities. The app runs in the data center nearest you, so it stays fast wherever your team works.
Always-on DDoS protection
The same network that protects millions of websites stands in front of Freesbe around the clock, absorbing attacks before they ever reach the app.
Encrypted everywhere it travels
Every page, message, file and live update moves over modern TLS encryption. Nothing is ever sent in plain text.
Encrypted wherever it's stored
Messages, files and recordings are encrypted at rest with 256-bit AES. Integration secrets and phone line credentials get a second layer of encryption, each under its own key.
Passwords we can't read
Passwords and sign-in tokens are stored only as one-way hashes. Not even our team can see them.
Redundant and always available
No single point of failure
Freesbe runs in every data center on the network at once. If one goes offline, traffic moves to the next nearest one automatically, without anyone lifting a finger.
Files stored redundantly
Every file and recording is copied across multiple devices and designed for 99.999999999% durability, so a failed disk never means lost data.
Point-in-time recovery
Our database keeps a continuous history, so it can be restored to any minute in the last 30 days if something ever goes wrong.
Zero-downtime updates
New versions roll out across the network in seconds, with no maintenance windows and no interruption to your calls or chats.
Security best practices
Least privilege
People, integrations and our own services get only the access they need. Production secrets live in managed secret storage, never in code.
Reviewed, tested changes
Every change to Freesbe goes through code review and an automated suite of type checks, tests and builds before it can ship.
Privacy by design
We collect only what's needed to run the service, never sell your data and show no ads. We list every provider that processes your data in our privacy policy.
Choose where your data lives
Each workspace picks where its data is stored: the European Union or the United States, where messages, files, recordings, transcripts and backups never leave the region, or Asia-Pacific or Oceania, close to the team.
Built for GDPR
We process workspace data only on your behalf and honor requests to access, export or delete personal data, so you can meet your obligations under GDPR.
On your devices
Encrypted local cache
Freesbe opens instantly because recent messages are kept on your device, sealed with 256-bit encryption under a key unique to you and your workspace. The key never touches the disk, so the cache is unreadable without signing in.
Wiped the moment access ends
Sign out, or lose access to a workspace, and its cache is erased. Deactivate someone and their key is replaced, so anything left on their laptop is useless.
Instant offboarding
Deactivating a member cuts off their access everywhere at once, on every device. Sessions expire on their own after 30 days.
Sign-in and access
Single sign-on
Sign in with Google or Microsoft. Accounts are only linked when the provider has verified the email address.
Required SSO
Admins can require everyone in a workspace to sign in through Google, Microsoft or either. Anyone who signed in another way is turned away. Included with Corporate and Enterprise.
Passkeys
Skip passwords entirely with Face ID, Touch ID, Windows Hello or a security key. Passkeys can't be phished or reused.
Required multi-factor sign-in
Owners and admins can require a second factor for everyone in the workspace: a passkey, an authenticator app or an emailed code, and choose how often people verify again. Included with every paid plan.
One-time email codes
Codes expire in 10 minutes and lock after five wrong guesses. Repeated sign-in attempts are throttled automatically.
Roles and guests
Owners, admins, members and guests each see only what their role needs. Guests see only the channels they were invited to, and you can require approval before any guest gets in.
Calls and recordings
Encrypted calls
Every call, video and screen share is encrypted from your device to the network, using the same standard built into every modern browser.
Nobody is recorded silently
When a recording starts, everyone in the call is told and hears a tone, a recording badge stays on screen, and anyone in the call can stop it.
Waiting room for guests
Guests joining a meeting wait in a lobby until someone from your workspace lets them in, so a forwarded link never lets a stranger walk into the call.
Recording controls for admins
Admins can turn recording off for the whole workspace, or, on Corporate and Enterprise, have recordings deleted automatically after 30, 90 or 365 days.
Hardened by design
Locked-down browser security
Freesbe tells your browser to refuse any script that doesn't come from us, and to never load the app inside another site. That shuts the door on the most common web attacks.
Uploaded files can't misbehave
Files are only available to signed-in members and are opened in a sandbox, so a malicious upload can't run inside the app.
Signed webhooks
Every outgoing webhook is signed and time-stamped, so your systems can prove it came from Freesbe. Webhooks can never be aimed at private networks.
Link previews that say nothing private
When an invite or meeting link is shared in another app, its preview shows only your workspace's name and logo. Never who sent it, which channels, or when the meeting is.
Built-in abuse limits
Daily limits on sign-in codes and invites keep Freesbe from ever being used to flood someone's inbox.
ISO/IEC 27001Certified
Independently certified
Freesbe is run under an information security management system certified to ISO/IEC 27001, the international standard for information security, with a scope covering our cloud communications platforms. Independent auditors check how we manage risk, access, changes and incidents, and re-audit us every year.
Need a copy of our certificate for a vendor review? Email sales@freesbe.net.
On the roadmap
These aren't available yet. We list them so you can plan, not as something you can rely on today.
SCIM and directory sync
Add and remove people automatically from Microsoft Entra ID (Azure AD), Okta and Google Workspace.
SOC 2 Type II
An independent audit of our controls. We'll publish here when it's done.
To be clear
- Freesbe is not end-to-end encrypted. Messages and files are encrypted in transit and at rest, and our service can read them to deliver, search and index them for your workspace. Call media is encrypted between each device and Cloudflare's media servers, which forward it to the other people in the call.
- We're certified to ISO/IEC 27001. SOC 2 is on the roadmap and not done yet. Our infrastructure provider, Cloudflare, publishes its own certifications.
- We don't sell your data or use it for ads.
Read our privacy policy for what we collect and who processes it, and our terms. Admins can find setup steps for SSO, guests and recordings in the docs.
Report a security issue
If you think you've found a vulnerability in Freesbe, email security@freesbe.net with what you found and how to reproduce it. We'll acknowledge your report within three business days and keep you updated while we fix it.
While you look, please:
- Only test with accounts and workspaces you own, and don't access other people's data.
- Don't run denial-of-service tests, spam, or social engineering against our team or customers.
- Give us a reasonable time to fix the issue before you share it publicly.
If you act in good faith and follow these guidelines, we won't take legal action against you. Our contact details are also in security.txt.
Questions about security for your company's review? Email sales@freesbe.net. Freesbe is made by Freesbe, Inc.