How call media is protected
What is encrypted, what path it takes, and exactly when it stops being only between you.
This page states the real posture, in plain terms. It deliberately avoids the phrase most collaboration tools reach for here, because for a call with a recorder in it that phrase would be false.
The media itself
Audio, video and screen shares in a Noots call travel over WebRTC, which encrypts media with DTLS-SRTP. That is not optional and cannot be switched off: a WebRTC connection without it does not exist. The keys are negotiated directly between the browsers taking part.
The path it takes
Calls are mesh peer-to-peer. Every person in the call holds a direct connection to every other person, and the media goes between those browsers — it does not pass through a Noots application server, and there is no media server in the middle decrypting and re-encrypting it. What our servers carry is the signalling: the messages that let two browsers find each other and agree on keys.
Some networks will not allow a direct path — strict or symmetric NAT, most commonly a corporate firewall. When that happens the media is relayed through a TURN server, which Cartex runs itself rather than renting from a third party. A TURN relay forwards encrypted packets; it holds no keys and cannot read what passes through it. If you self-host Noots, you point it at your own relay and no Cartex infrastructure is involved in a call at all.
When it stops being only between you
The recorder is a real participant. It joins the mesh like a person, so it receives everyone's audio — and, where the screen watch is switched on, the shared screen — decrypted at its end, which is what lets it record and transcribe them at all. That is not a weakness in the encryption; it is what admitting a recorder into a room means, and no product can give you both a transcript and a room only the humans can hear. Noots' obligation is to make it unmissable while it is true, which is why a banner naming the bot is on screen for everyone in the call for as long as it is there, and why it says in the call that the call is no longer only between the people in it.
Without the bot, nothing decrypts your call except the browsers of the people in it. With the bot, that set gains one member, and the transcript it produces is stored in your workspace under the same permissions as any other meeting.
What is stored
- Nothing of a call's live media. There is no recording of a call unless somebody adds the bot.
- With the bot: the mixed audio it captured, and the transcript and summary made from it, as an ordinary Noots meeting.
- With the screen watch on: the bot's short written descriptions of what was being done, which are deleted with the call. The frames themselves are never written anywhere — not to a column, a file or a log.
- Signalling metadata: who called whom and when, which is what the call log in the conversation is made of.
Because it would be doing work it has not earned. A call with no bot in it does have that property, and we would rather describe the mechanism — DTLS-SRTP, mesh, our own relay — than lean on a phrase that a reader will carry over to the calls where a recorder is present and where it stops being true.