Security & privacy

Built to keep your classes private

Schools trust us with students’ classes, and businesses with their conversations. Here is exactly how we protect them — no buzzwords.

Every connection to GurukulLive — web app, API and real-time signalling — uses HTTPS / TLS.
Audio and video use WebRTC, which encrypts media with DTLS-SRTP.

Cloud recordings are stored in Cloudflare R2, which encrypts stored objects at rest.
Playback uses short-lived signed links that expire automatically.

Passwords are stored only as salted bcrypt hashes; reset links are single-use and expire.
Sessions use HttpOnly cookies with rotating refresh tokens; reuse of an old token signs the account out everywhere.
Sign in with Google is supported for every account.

Owners, admins, teachers and students each see only what their role in an organization allows.
Data is scoped to the organization: members of one organization can’t see another’s classes or recordings.

Waiting room, meeting passcodes (stored hashed), meeting lock and organization-only meetings.
Host actions such as mute, remove and permissions are enforced on the server, not just in the app.

Admins can review an audit log of important actions in their organization.
GurukulLive staff can only access an organization’s data through time-limited support access that the organization approves.

On the roadmap

What we’re working on next

These are planned — not available today. We’ll update this page as each one ships.

Hosting meetings, recordings and data in an India region for organizations that need it.

Planned

Authenticator-app codes for every account, enforceable by organization admins.

Planned

OIDC and SAML sign-in with your identity provider, plus SCIM provisioning.

Planned

Please report it privately to security@trinetraailabs.com. We acknowledge reports within 48 hours and won’t take action against good-faith research.

Read our privacy policy for how we handle personal data.