Security & deploymentClear boundaries.
Clear boundaries.
Informed decisions.
Choose the deployment and operating responsibilities that fit your organization. Review the supported controls, configuration and limitations with our team before agreeing your deployment.
Security review
Four areas to review together.
Explore the scope of identity, documents, administrative authority and audit information. Availability and behavior depend on the agreed product version and deployment.
Compare deployment responsibilities.
Hosting location, operational ownership and isolation are separate decisions. Document each of them for the proposed environment.
Customer-operated infrastructure
Agree application, network, update, backup and support-access responsibilities. Confirm any feature-specific external connections.
Defined cloud environment
Confirm the operator, dedicated and shared components, administrative access and provider responsibilities.
Specified hosting locations
Confirm primary storage, backups, logs and support-access locations. A hosting location alone does not describe every data flow.
Connected operating environments
Map data movement, identity, keys, support and recovery across customer and cloud components.
Understand the limits of document controls.
Watermarks
Watermarks can support deterrence and investigation. They do not guarantee prevention or identify the source of every disclosure.
Screen capture
Restrictions depend on the supported operating system, app and device policy. They cannot prevent someone photographing a screen with another device.
Downloads and sharing
Review viewing, download and export permissions together. Files exported outside the app require their own protection and handling rules.
Revocation and offline access
Revoking in-app access is different from deleting an external copy. Confirm how long offline access lasts and when devices must reconnect to revalidate access.
Agree the encryption and key-access model.
Request the transport and storage coverage for messages, files, logs, backups and device caches. Confirm who can use decryption keys and whether servers or administrators can access message content. TLS and encryption at rest are not, by themselves, end-to-end encryption (E2EE).
Define the scope before making an assurance decision.
An isolated, in-country or offline deployment needs its own documented boundaries and operating procedures. Discuss connectivity, update delivery, customer and vendor responsibilities, and the documents needed for your review. Website descriptions and illustrative screens are not independent assurance or regulatory approval.