Message privacy

Effective 2026-09-13.

Conversations inside a workspace are private to that workspace. Message bodies and uploaded attachments are encrypted at rest with a data key that belongs to the workspace, so our own staff cannot read them while operating the platform.

What is encrypted

Message text, including thread replies and edits.
File and voice attachment contents.
Search indexes are stored as one-way hashes, not as readable text.

What remains visible as metadata

Running the service requires some information to stay in the clear. Support and platform staff may see:

Who sent a message, in which channel and workspace, and when.
Message and attachment counts, file sizes and file types.
Delivery, billing, audit and error records tied to an account.

Support conversations you start with X-Com directly are, by their nature, readable by our support team — they are addressed to us. Those are separate from your workspace channels.

Who can decrypt

Decryption happens only on requests authenticated as a member of the workspace that owns the content. Each workspace has its own data key, wrapped by a master key held in the server secret store and never written to the database alongside the data it protects. Administrative database tooling used by our staff has no access to unwrapped content keys, and our admin, CRM and analytics surfaces do not query message content columns at all.

Key handling

One data key per workspace, versioned so keys can be rotated.
Keys are wrapped by a master secret held outside the database; losing the database alone does not expose message content.
Deleting a workspace destroys its content key along with its data.

What this means for support