Security

Calls

• Each call has two participants. Audio and video go directly between the browsers over WebRTC and are always encrypted with DTLS-SRTP. The encryption keys are negotiated by the two browsers; our servers never receive them.
• When a firewall blocks a direct connection, media is relayed through our own TURN server using credentials that expire after one hour. The relay forwards encrypted packets and cannot read them.
• Browsers contact a public STUN server run by Google only to discover their public network address. No media passes through it.
• Our signaling server passes only the messages needed to set up the connection. It holds them in memory during the call and does not store them.
• Talkra does not record calls. Optional text chat is not saved, so no call content ends up on our servers.

Who can join

• Joining requires a signed token that is valid only for that specific room.
• Scheduled call links stop working once the call's end time has passed.
• In a permanent room, guests wait until the host is present and admits them.
• A room admits at most two participants; any further connection is refused.

Accounts

• Passwords are stored only as salted hashes made with a modern password hashing algorithm. With Sign in with Google, we store no password at all.
• Access tokens expire after 15 minutes. Refresh tokens are single-use: each renewal issues a new one, and reusing an old one signs out the whole session chain. We store refresh tokens only as keyed hashes.
• Settings lets you sign out on all devices at once.
• Repeated failed sign-ins trigger temporary lockouts, and sign-in, registration, password reset and email change requests are rate-limited.
• Verification codes expire after 10 minutes and password reset links after 1 hour. Changing your sign-in email requires a code sent to the new address, and we notify the old one.
• Your data export leaves out secrets such as password hashes, session tokens and the calendar feed link.

Infrastructure

• The website, API and signaling connection are served over HTTPS and secure WebSockets. Browsers allow camera and microphone access only on secure connections.
• Our servers and database are hosted by DigitalOcean in Europe, France.
• Pages are served with headers that prevent them from being embedded in other sites or misinterpreted by the browser.
• The admin panel is available only to staff accounts.

Collecting less

• No analytics or advertising trackers.
• An account needs only an email address, and guests need no account at all.
• Expired sessions, codes and reset links are purged automatically, and deleted accounts are erased after the 14-day grace period.

Read the Privacy Policy

Reporting a vulnerability

If you think you have found a security issue, email contact@talkra.eu with the subject "Security report". Please include steps to reproduce it, do not access or change other users' data, and give us reasonable time to fix the issue before disclosing it. We will confirm receipt and keep you informed.