Trust and security

Coldge's database, files, backups, encryption keys (Azure Key Vault) and server logs are stored on Microsoft Azure, UAE North (Dubai). File storage is set up as zone-redundant: copies sit in separate data centres inside UAE North. Backups, including a locked copy that can't be changed or deleted for 30 days, stay in the same region. There is no second region.

Some data is processed outside the UAE by the providers below, such as Cloudflare, Vercel, Resend, Apple, Google, Expo and Zoom. So we don't say all your data stays in the UAE.

End-to-end encrypted (E2EE) messages can be read only on the chat members' devices. Everything else is stored in a form Coldge can read.

E2EE does not cover:

• Metadata: who sent a message, to which chat, when, its size, and who was mentioned.
• Read receipts: senders, and staff in their channels and private chats, see who received and read each message. They can't be turned off.
• History: making a group private encrypts only new messages.
• Staff devices: Coldge's server approves staff devices in private university chats from their Microsoft role, so there you rely on Coldge's server.
• Reports: anyone in a chat can report it, which shares a readable copy.
• The web app: it runs whatever code app.coldge.com serves.

Calls are not end-to-end encrypted. The Coldge app has no call recording feature; calls run through a third-party video service (Zoom).

You can report a message, person, group, post, comment, event, file or organization in the app.

• Reporting a message sends a readable copy of it plus up to 10 messages before and 10 after, including other people's messages and the photos, videos and files in that range. The app tells you this first. The others in the chat are not told.
• Reporting a person or group can include the chat's last 10 messages (ticked by default).
• Who reads it: Coldge moderators, and the Operators and Administrators of the university that owns the reported content or space.
• Logging: Coldge's reads are logged. University staff reads are not logged yet.
• People review reports. There is no automated content scanning and no 24-hour moderation team.
• Reports and their copies have no time limit today, even after the accounts are deleted.

Last reviewed: 19 October 2026. We use no advertising, third-party analytics or AI services.

Notification text. Notification previews may show the sender, the chat name and the start of the text for chats that are not end-to-end encrypted, posts, comments and account notices, and they pass through Apple, Google and Expo. Notifications for end-to-end encrypted chats carry only encrypted content. Call notifications always show the caller's name and photo. A server setting can make previews generic; until this page says it is on, assume previews are sent.

As built today. "No limit" means nothing deletes it on a schedule yet.

Backups are kept for about 40 days. Storage safety features can keep deleted files recoverable for up to about 60 days and backups for up to about 70 days, and we are still confirming that our locked backup copies are removed on schedule.

In place:

• In transit: HTTPS with TLS 1.2 or later.
• At rest: Azure platform encryption with Microsoft-managed keys. Chat history on your device is in an encrypted database. Microsoft sign-in tokens are encrypted with AES-256-GCM.
• Access control: database row-level security and role checks.
• Staff sign-in: university staff sign in only with Microsoft through their university. Coldge's Operations sign-in requires Microsoft multi-factor authentication, and sensitive actions, such as deleting a university, need a fresh sign-in within two minutes.
• Audit logs of staff actions in both dashboards.
• Malware scanning: University Drive files and problem-report screenshots are scanned for malware, but a file can be visible before its scan finishes. Files found to contain malware are deleted. Files in end-to-end encrypted chats can't be scanned. The uploader of a deleted Drive file is told.
• Backups: daily, with transaction logs archived at least every 15 minutes and a locked 30-day copy, all in UAE North. One full restore test, on 26 August 2026.
• Checked deploys: every code deploy passes automated type, security, dependency and database checks.
• Rate limits on sign-in and other sensitive actions.

Not in place yet:

• Independent penetration test or encryption review; SOC 2 or ISO 27001.
• Coldge checking MFA for university staff (today it depends on each university's Microsoft settings).
• Holding Drive files until scanned.
• Customer-managed keys, a standby server or a second region.
• Regular, timed restore tests.
• Logging of university staff reading reports or read receipts.
• A written breach-notification procedure with set timelines.
• A second person with production access, or 24-hour monitoring (alerts go by email).

Delete your Coldge account in the iOS or Android app or at app.coldge.com: Profile, then Delete Account. Confirm with your password, and with the code we email to your personal email if you have turned on multi-factor authentication. Deletion is immediate and can't be undone; some data is kept, as shown under Retention. If you can't use that screen, for example because your account is suspended or your university is paused, email support@coldge.com and we will delete your account for you once we have confirmed it's yours.

For a copy of your data, email support@coldge.com and we will send it to you. We answer within 30 days. There is no self-service export yet.

Coldge prohibits child sexual abuse and exploitation of any kind. Our child safety standards, including how to report it and what we do, are in the "Coldge child safety standards" section of the Community Guidelines. Child safety contact: support@coldge.com.

Email security@coldge.com with what you found and where (URL, app version or endpoint), steps to reproduce, the likely impact, and how to reach you.

• We aim to acknowledge within three business days, sooner for serious issues, and will keep you updated until it's fixed.
• There is no bug bounty.

Good-faith research. If you use only your own test accounts, access no more data than needed to show the problem, don't view, change or delete other people's data, don't disrupt the service (no denial-of-service or high-volume scanning), and give us reasonable time to fix it before publishing, we won't take legal action against you or ask anyone else to. This covers Coldge only. Social engineering, physical attacks and attacks on our providers are out of scope.

Contact details are also in security.txt.

We have not had an accessibility audit and don't claim WCAG conformance. Our goal is WCAG 2.2 level AA.

Done so far: light, dark and system appearance; the app doesn't override your device's text size; many controls have screen-reader labels.

Known gaps:

• Not fully tested with VoiceOver, TalkBack or desktop screen readers; some icon-only buttons may lack labels.
• Some screens may not fit well at the largest text sizes.
• English interface only. You can write and search in Arabic, but there's no Arabic or right-to-left interface yet.
• No transcripts for voice messages or captions for calls.

To report a problem, email support@coldge.com with "Accessibility" in the subject, naming the screen, your device and any assistive technology.

We are preparing a Data Processing Agreement, a Privacy Datasheet and a Security Overview for university IT and privacy offices. To ask for them, email business@coldge.com.

As of 19 October 2026:

• Coldge is operated by the Coldge team, based in Abu Dhabi, United Arab Emirates. A limited liability company is being set up and will take over this role.
• Coldge is preparing for its first university pilots. The team runs development, operations, moderation and security.
• Independent certification (SOC 2 or ISO 27001) and an independent penetration test are planned; neither is in place yet. The encryption design has had an internal review.

We record changes to providers, storage locations and security practices here. Universities with a data processing agreement will be told of provider changes as that agreement sets out.