Skip to content
Lobbly
Start free trial

Security

How Lobbly protects workspaces

Security is part of Lobbly's product and operations lifecycle. This page describes the protections currently in place without claiming a certification or an absolute guarantee against every risk.

Infrastructure and hosting

  • The Lobbly application and managed database are hosted in France on Scaleway infrastructure.
  • Application services run as non-privileged system users and do not expose their internal Node.js ports publicly.
  • Production secrets and database credentials are stored outside application releases.
  • Database backups are managed separately from the application runtime.

Encryption and communications

  • Web traffic is protected in transit with HTTPS.
  • Audio, video and screen-sharing streams use the encrypted transport provided by WebRTC.
  • The managed production database uses encryption at rest.
  • Uploaded files are stored in a private Scaleway Object Storage bucket with encryption at rest.
  • Connected-calendar OAuth tokens are encrypted before being stored.

Real-time media is routed through Lobbly's meeting infrastructure to provide the service. Lobbly does not record audio, video or screen sharing by default, and does not currently advertise end-to-end encryption.

Accounts and access control

  • Passwords are stored with one-way bcrypt hashing and are never stored in plain text.
  • Authentication sessions use protected HTTP-only cookies and server-side authorization checks.
  • Workspace membership, roles, private channels and meeting admission are enforced by the application backend.
  • File permissions are enforced by the backend before any short-lived upload or download URL is issued.
  • Optional Google sign-in links only to an existing verified Lobbly account with the same verified email address.

Monitoring and maintenance

Lobbly monitors its production services, records security-relevant events, applies dependency and application updates, and maintains documented incident-response and recovery procedures. Security controls are reviewed as the product and infrastructure evolve.

Responsible disclosure

If you believe you have found a security issue, contact hello@lobbly.io. Include a concise description, reproduction steps and the possible impact. Please do not access another person's data, disrupt the service or disclose the issue publicly before we have had a reasonable opportunity to investigate it.

Security and privacy questions

For questions about personal data, retention or your rights, see the privacy policy. For other security questions, contact hello@lobbly.io.

Last updated: 29 July 2026.