Security

How Lobbly protects workspaces

Security is part of Lobbly's product and operations lifecycle. This page describes the protections currently in place without claiming a certification or an absolute guarantee against every risk.

Infrastructure and hosting

• The Lobbly application and managed database are hosted in France on Scaleway infrastructure.
• Application services run as non-privileged system users and do not expose their internal Node.js ports publicly.
• Production secrets and database credentials are stored outside application releases.
• Database backups are managed separately from the application runtime.

Encryption and communications

• Web traffic is protected in transit with HTTPS.
• Audio, video and screen-sharing streams use the encrypted transport provided by WebRTC.
• The managed production database uses encryption at rest.
• Connected-calendar OAuth tokens are encrypted before being stored.

Real-time media is routed through Lobbly's meeting infrastructure to provide the service. Lobbly does not record audio, video or screen sharing by default, and does not currently advertise end-to-end encryption.

Accounts and access control

• Passwords are stored with one-way bcrypt hashing and are never stored in plain text.
• Authentication sessions use protected HTTP-only cookies and server-side authorization checks.
• Workspace membership, roles, private channels and meeting admission are enforced by the application backend.
• Optional Google sign-in links only to an existing verified Lobbly account with the same verified email address.

Monitoring and maintenance

Lobbly monitors its production services, records security-relevant events, applies dependency and application updates, and maintains documented incident-response and recovery procedures. Security controls are reviewed as the product and infrastructure evolve.

Responsible disclosure

If you believe you have found a security issue, contact bonjour@lobbly.io. Include a concise description, reproduction steps and the possible impact. Please do not access another person's data, disrupt the service or disclose the issue publicly before we have had a reasonable opportunity to investigate it.

Security and privacy questions

For questions about personal data, retention or your rights, see the privacy policy. For other security questions, contact bonjour@lobbly.io.

Last updated: 28 July 2026.