Written for the person who has to sign off on it

Where your data lives

Residency is a property of which server you reach, not a routing decision inside one. That is deliberate: a guarantee that depends on every future code change remembering to ask is a guarantee that will eventually be broken by a patch nobody reviewed for it.

One server per region

A Knockin server declares which region it is in. An organization whose data belongs to another region is refused by it outright — 421, with the region that can serve you named in the response. There is no per-tenant routing to get wrong.

The AI never leaves either

Knockin AI — answers, meeting notes, transcripts and search — runs on Knockin’s own servers beside your data, using open models. No AI company receives your content, and the server refuses to be pointed at one: a hosted-AI address is rejected, not quietly used.

What this does not do

A single server cannot serve two regions, and there is no setting that moves an organization between them. Migration is export, restore in region, repoint — an operational procedure we run, not a toggle.

Who can see what

One permission table

The API, the realtime gateway and the web client all read the same table, so a hidden button and a refused request can never disagree. Roles do not inherit from each other automatically — where a senior role holds a junior one’s permission, it is written out, because inheritance is how a field worker quietly ends up able to edit a floor plan.

Tenant isolation is enforced, not remembered

A database extension rejects any query against a tenant-scoped model that does not name an organization. Fifty-seven models are covered and a build-time check fails if a new one is added without being registered. Cross-tenant work has to be written deliberately, in one place, with a comment saying why.

Information barriers

Two groups of departments can be prevented from messaging each other. Putting a barrier up also closes the conversations that already crossed it — frozen, never deleted, because deleting them would destroy the record of the thing the barrier exists to prevent.

An API key is not a person

Keys hold explicit scopes and there is no scope that means everything. A key cannot read a private channel or a direct message whatever scopes it has, cannot create another key, and cannot see a field worker’s position. The key itself is shown once and stored only as a hash.

Recording, transcripts and consent

Off by default, per room

Recording is a room policy, enforced in the media service rather than in the client. A room marked no-record cannot be recorded by anybody, including an owner.

The notice comes first

The server will not start a recording until the room has been told, and for an all-hands the server broadcasts the notice itself rather than trusting a client to say it displayed one. Somebody who joins twenty minutes late is told on arrival.

End-to-end encrypted rooms cannot be recorded at all

Not "will not" — cannot. Recording and transcription are impossible in an E2EE room, the AI policy for it is forced off, and the interface says so before the room is created. A privacy feature that silently permits recording is not a privacy feature.

Only the host

A presenter was handed a microphone, not the room. Starting and stopping a recording needs the same permission, and both are audit events naming who did it.

Field staff, which is the most sensitive part

A product that tracks where people are has to be more careful than one that does not, and the carefulness has to be visible to the person being tracked rather than only to the person who bought it.

Location only while a shift is open

There is no code path that samples a worker’s location outside an open shift. This is tested rather than trusted.

The worker can see what you can see

A persistent indicator while sampling, the retention period shown in their own app, and the number they are shown is the number the deletion sweep enforces. If those ever disagreed, the app would be lying to somebody about where they have been.

Supervisors see position; peers do not

Colleagues see status only. A guard cannot look up where another guard is.

Consent is withdrawable

Withdrawing it blocks starting a shift rather than silently tracking anyway.

Retention, holds and getting your data out

Named retention classes

Set per workspace and overridable per channel, longer or shorter. Permanent by default: a product that quietly started deleting a company’s messages would lose evidence, where keeping everything merely costs disk.

A legal hold beats everything

While a preservation order covers somebody, erasure is refused and every retention sweep leaves their data alone — whoever asks, including an owner. If the sweep cannot read the list of holds, it deletes nothing rather than proceeding without the veto.

Export and erasure

Anybody can ask for a complete copy of their own data without an administrator’s permission. Erasure anonymizes the person, deletes their personal media and tombstones authorship while leaving the organization’s own records intact. When an administrator exports somebody else’s data to answer a subject-access request, that person is told, by name, in their own inbox.

An audit log you can actually read

Append-only — there is no code path in the product that edits or deletes an entry. Sign-ins, recordings, exports, erasures, holds, barriers, permission changes and visitor admissions, each with who, when, and the before-and-after.

The ordinary things

• TLS 1.3 in transit; encryption at rest on the database and on stored files.
• Passwords hashed with Argon2id. Optional two-factor authentication with recovery codes.
• Sessions are revoked immediately when somebody is deactivated — not on their next page load.
• Rate limits per address, tighter on the authentication routes than anywhere else.
• Webhook endpoints cannot point inside our network, and every delivery is signed with a timestamp so a captured request cannot be replayed.
• No third-party scripts, analytics or fonts on the application. Nothing about your staff reaches anybody else as a side effect of loading a page.

What we have not done yet

A security page that lists only strengths is one nobody technical believes. These are the real gaps, and we would rather you heard them from us.

SOC 2 Type II

Not certified. The controls are built the way an audit expects, so getting there is a documentation exercise rather than a rebuild — but it has not been done, and we will not imply otherwise.

Files are on the application server

Uploads, recordings and export archives sit on the server’s own disk rather than in object storage. They are backed up; they are not yet replicated. This is the next piece of infrastructure work and it is the reason a deployment is one server today.

Single-tenant single server

One database, one cache, one of each service per region. A reboot is downtime. For the first customers this is the right trade and we would rather say so than describe a redundancy we do not have.

Penetration test

Not yet commissioned.