SECURITY AND COMPLIANCE
Your data has one address. Yours.
OnlySmack runs on servers your organisation owns, in the country you choose. Every meeting, message, file, password and log stays in storage you control, and every access is on record.
What you own.
Your conversations are organisational records.
Messages, threads and polls live in your own database, on your server.
Your files, recordings and passwords are in your storage.
On the server itself, or in storage you run or choose, in your own country.
No one at Wolfiz can read your data.
We have no access to your install unless you invite us, for example during installation, and you can remove that access when we’re done.
Leaving is simple.
It is your database and your storage. There is nothing to get back from us.
Where everything lives.
Two places hold everything: your database and your storage. Both are yours.
| What | Where it lives |
|---|---|
| Messages, threads, reactions and the audit log | Your database, on your server |
| Files, recordings, whiteboards and transfers | Your storage: on the server, or storage you run or choose |
| Team passwords in Vault | Encrypted, on your own server |
| Calls and meetings | Your server. They never pass through Wolfiz. |
| AI transcripts and summaries | Processed on your own server |
| Email notifications | Your own email server |
| Desktop app updates | Your server |
Who can see what.
From an outside party who gets one file to the head of your organisation, each person sees only what their part needs.
Only those files, until the link expires, behind a password if you set one.
Only that meeting, and only after being let in or entering the passcode.
Public channels, the channels their roles open, and their own conversations.
Also manages that channel’s members and who may post in it.
Manages people, roles and settings. Every action is written to the audit log.
Holds the CEO role: everything an admin can do, and can never be locked out.
Read receipts show “Seen by” only to the person who sent the message.
Bar length shows how broad each person’s view is, not an exact measure.
Shield: the controls you hold.
Each one is a switch your security team sets in one console, not a promise we make.
- Get AI alerts on unusual sign-ins and mass downloads, sent to your security team.
- Restrict sign-in to approved networks, with named exceptions for people who travel.
- Export a tamper-evident audit trail for your auditors, whenever they ask.
- Keep records as long as your retention rules say, and place a legal hold when a case opens.
- Share credentials from Vault without revealing them, and revoke them in one step.
- Sign people in with your own employee IDs, with no email needed.
- Set what each role can do. Channels open and close with the role.
- Limit who can post in announcement channels.
- Set how long messages stay editable: 5 minutes by default, the same for everyone.
- Lock meetings, use waiting rooms and passcodes, and remove anyone.
- Recordings are always announced with a visible REC sign. Nobody is recorded silently.
- Put passwords and expiry dates on file transfers, and revoke any transfer.
- Choose whether message text appears in email and browser notifications.
When someone leaves.
Leavers cause more leaks than ciphers do. Here is exactly what happens.
- From active to deactivated
Deactivate.
One click ends their sessions, cancels the meetings they host, stops their transfer links and removes their Vault access.
- HISTORY KEPT
History stays.
Their messages stay where they were, as organisational records.
- DELETED
Delete for good, if you must.
Only the CEO role can do it, by typing the person’s name to confirm. An entry stays in the audit log.
A record nobody can quietly rewrite.
Sign-ins and failed sign-ins, role and permission changes, settings, meetings, transfers, downloads and deletions are written down with who, what and when. The trail is tamper-evident, it exports for review, and it lives in your own database, where your auditors can read it.
| When | Who | What |
|---|---|---|
| 08 Oct 09:12 | Priya Raman | Role assigned: Hana Kobayashi → Team Lead |
| 08 Oct 09:14 | Priya Raman | IP policy updated: Remote engineering |
| 08 Oct 11:02 | — | Sign-in failed: msilva (wrong password) |
| 08 Oct 11:03 | — | Sign-in blocked: msilva (outside office network) |
| 08 Oct 16:40 | Liam O’Connor | Transfer revoked: Apollo field kit |
| 08 Oct 17:05 | Priya Raman | Account deactivated: Daniel Mensah |
Backups are two jobs.
Because OnlySmack runs on your server, your backups follow your organisation’s policy. OnlySmack keeps everything in two places, so a backup is two well-known jobs.
Back up the database.
Messages, people, settings and the audit log. A nightly database backup covers it.
Back up the storage.
Files, recordings and transfers. Turn on versioning in your storage, or copy the bucket.
Our installation service sets up daily database backups and storage versioning for you.
COMPLIANCE
Designed to support
the frameworks you answer to.
OnlySmack is designed to support ISO/IEC 27001, SOC 2, GDPR, NIST CSF 2.0, NIST SP 800-53, OWASP ASVS, CIS Controls and national data residency requirements. Your organisation is the one that gets assessed. Self-hosting keeps every record inside your own scope and your own country, and the Shield controls (approved networks, role-based access, tamper-evident audit trails, retention and legal hold) give your auditors the evidence they ask for.
We fill it in line by line, against the framework you name.
- ISO/IEC 27001
- SOC 2
- GDPR
- NIST CSF 2.0
- NIST SP 800-53
- OWASP ASVS
- CIS Controls
- National data residency
What OnlySmack doesn’t do yet.
We’d rather tell you now than in your security review.
Ask about the roadmap- Not yetSingle sign-on (SAML, OIDC) and SCIM provisioning
- Not yetTwo-factor sign-in
- Not yetEnd-to-end encrypted messages
- Not yetBulk export of all data from inside the app
Found a security problem?
Write to us. We reply within 2 business days, and we’ll tell you what we’re doing about it.
Questions.
Something else? Talk to us →
Is our data encrypted on the way?
Yes. Every app connects to your server over HTTPS.
Is our data encrypted when stored?
Your storage’s own encryption covers files and recordings, and your server’s disk encryption covers the database. You choose both.
Can Wolfiz read our messages?
No. Your install runs on your server, and we have no access unless you give it to us.
Can we run our own penetration test?
Yes. It’s your server.
Which frameworks does OnlySmack support?
It is designed to support ISO/IEC 27001, SOC 2, GDPR, NIST CSF 2.0, NIST SP 800-53, OWASP ASVS, CIS Controls and national data residency. Your organisation is assessed, not the software; OnlySmack gives you the controls and the records to show.
Where does the AI run?
Meeting transcripts and summaries are processed on your own servers. Recordings are never sent to an outside AI service.
Can we get this as a document for our IT team?
Yes. Ask us and we’ll send a one-page security summary.
NOTHING LEAVES. UNLESS YOU SEND IT.
Bring your security questionnaire; we’ll answer it line by line.
Your server · your database · your storage