SECURITY

Private meetings by default

In every Gubae meeting, audio, video, screen sharing and in-meeting chat are end-to-end encrypted on participants' devices, so our servers relay them without being able to read them. Captions, cloud recordings, AI summaries, whiteboards and polls are not end-to-end encrypted. Accounts are protected with two-factor authentication, sign-in limits and device management, and stored data is encrypted at rest.

End-to-end encryption in every meeting

The meeting key is created in the browser of the first person to open the meeting and travels in the invite link, in the part of the address that browsers never send to our servers. Participants must open the complete invite link to receive the meeting key. A meeting ID alone cannot provide the key, and our servers do not distribute it. Our media servers pass the encrypted streams along but cannot decrypt them. A browser that cannot encrypt is not able to send or receive meeting media, so no meeting falls back to an unencrypted mode.

Each meeting shows a security code. If everyone sees the same code, everyone is using the same key. For sensitive meetings, share the invite link rather than the meeting ID, and compare the code out loud.

Some meeting features are not end-to-end encrypted. Live captions come from your browser's speech recognition, which may send your audio to the browser maker's service, and caption text passes through our servers. Cloud recordings are made in the recording host's browser and stored on our servers. Saved notes and transcripts are stored on our servers, and AI summaries are generated by Anthropic when someone asks for one. Whiteboards, polls, reactions and meeting details such as the title, the time and who joined also pass through our servers.

Control who joins

Everyone signs in before joining, so hosts know who is in the meeting
Waiting rooms, where the host admits each person
Meeting passcodes, with limits on repeated wrong guesses
Removing a participant disconnects them, and they cannot rejoin that meeting
Everyone sees when a meeting is being recorded, including people who join later

Account protection

Two-factor authentication with an authenticator app and recovery codes
Limits on repeated sign-in attempts, per account and per network
Single sign-on with your organization's identity provider
A list of your signed-in devices, which you can sign out remotely
Payment keys, chat and support messages encrypted at rest

Your data and your rights

We do not sell personal data, show ads or use your meetings, messages or files to train artificial intelligence. You can download a copy of your data or delete your account yourself in Settings. Gubae is operated from Ethiopia under the Personal Data Protection Proclamation No. 1321/2024, and we also honour rights under the GDPR and US state privacy laws.

Frequently asked questions

Is Gubae end-to-end encrypted?

Yes, for what you see and hear. In every meeting, audio, video, screen sharing and in-meeting chat can be read only by the participants' devices, not by Gubae's servers. Captions, cloud recordings, notes, AI summaries, whiteboards and polls are not end-to-end encrypted.

Can Gubae see my meetings?

We can't see or hear meeting audio, video, screen shares or in-meeting chat: they are encrypted with a key held by participants' devices. We can see meeting details such as the title, the time and who joined, which we need to run the service, and content that isn't end-to-end encrypted, such as captions passing through and recordings, notes and summaries saved to the cloud.

Can I record an encrypted meeting?

Yes. Recording happens in the host's browser, where the meeting is already decrypted, and the file is then saved to the cloud. Everyone in the meeting is told it is being recorded.

Where can I report a security problem?

Email the security contact listed in our security.txt file and on the Acceptable Use Policy page. Please give us reasonable time to fix a problem before disclosing it.

Create a free account · See plans and prices