Trust & Compliance
Security Architecture
How Kollab protects your media streams, organization workspaces, private messages, and meeting data.
Signed Media Access Tokens
LiveKit room tokens are generated and signed strictly server-side using secure HMAC-SHA256 signatures with ephemeral lifetimes. No secrets are ever provided to client code.
Server-Side Authorization & RBAC
All meeting actions (muting participants, admitting from waiting room, accessing recordings, querying AI) verify organization and user permissions on the server before execution.
Isolated PostgreSQL Database Storage
Normalized database tables with relational foreign keys and organization scopes ensure strict workspace tenant isolation.