Ollasync started from a simple discomfort: the conversations and documents that matter most — a deal, a case, a diagnosis, a board decision — were running through tools designed for convenience, where the provider can read everything. “Trust us” is not a security model.

So we built the opposite. Identity and media keys are generated in your browser. Each room has a single key that’s shared only through the invite link — never with our servers — and chat, audio, video and screen share are all encrypted with it (AES-GCM). Our relay and media servers move encrypted bytes they cannot read. We prove that property with end-to-end tests — a wrong-key participant decodes zero frames — rather than asserting it in a policy document.

We’re a small, focused team, and we’re honest about where we are: the encryption is real and continuously tested, but we don’t yet hold an external cryptography audit or SOC 2 / ISO 27001, and MLS-style group key agreement (with forward secrecy) is on our roadmap rather than shipped. If certification status matters to your procurement, ask us directly — we’ll tell you exactly where things stand today.

Our shared cloud is hosted in the EU (Frankfurt). For Switzerland or another jurisdiction you can run Ollasync single-tenant, or self-host the entire stack inside your own perimeter. Your data, your jurisdiction, your keys.