Security Practices

1. Our approach

We run our own rooms on ConferenceRooms.org, so the Service's security is personal to us. Security, privacy and confidentiality are core to the business, not a department. This page describes current practices; it grows as the industry does. The Privacy Policy and Terms of Service are part of the same picture.

2. Encryption in transit

Everything travels encrypted: the web chat over HTTPS, and chat programs over SSL/TLS on port 8897. Never send passwords or sensitive details over an unencrypted connection, and check for the secure indicator in your browser or client before signing in.

3. Accounts and access

Register your nickname with a strong, unique password and keep it secret. Founders hand out exactly the power each helper needs through six levels, from member to founder; operators and voiced helpers are visible in the people list. On a shared or lost device, change your password immediately and tell us so we can help lock the account.

4. Rooms and moderation

Founders choose who gets in: open, hidden, invite-only, key, or registered-only; topics and settings can be locked; language filters stop unwanted words at the door. Kick, ban and autokick remove trouble fast. Our staff can enter any room to help and cannot be removed by room operators. Abuse reports go to #CR or /contact/, with the room name and time.

5. Records

Rooms using CR Scribe publish their conversation to a web page as it happens, each day sealed with a SHA-256 fingerprint so tampering shows. Treat logged rooms as on the record. Registered-only rooms and private chats narrow who can ever see a word.

6. What we ask of you

Keep clients and browsers updated. Never share passwords, not even with staff: we will never ask for yours. Beware of look-alike room names and links; every link asks before it opens. If you believe you found a vulnerability, tell us right away through /contact/ and we will investigate quickly.

7. Availability and honesty

We build for resilience: redundant copies of data, practiced recovery, and staff on call. We announce planned work that matters in advance. We do not claim certifications we have not earned; when our practices change, this page changes with them.

8. Memos (MemoServ)

Memos move over the same encrypted connections as everything else and are readable only by sender and recipient: never logged to Scribe pages, never translated, never shared.

Deletion is permanent and immediate across live systems; deleted memos are not backed up and cannot be restored. Delivery is best-effort by design: while either side stays offline the memo waits, and we are not responsible for delayed delivery or for any failure to send, receive or display a memo.

9. CR Scribe records may contain errors

Scribe writes what the network delivers, as it delivers it. Dropped connections, reconnects and outages can all leave a page incomplete or out of order, and nicknames can mismatch across sessions. The daily seal detects tampering afterwards; it cannot fill gaps. Treat every Scribe page as a best-effort record, not a certified transcript.

10. CR Translation may be wrong, slow or unavailable

CR Translation trades accuracy for speed, and sometimes loses both: expect errors with slang, names and short lines, delays and outages at busy times of day or week, and no guarantee for any particular language. Translated text may replace or distort the original words, and we are not responsible for misunderstandings that follow. Confirm critical points in a shared language.