Security at Gochi

How we keep your data safe.

Plain facts about how Gochi protects your business and your clients: what we do, and where something isn't in place yet, we say so.

Signing in

Two-factor sign-in is required for every user of every organisation: an authenticator app, or a passkey.
Admins choose how often the second factor is asked for: every sign-in, daily, weekly or monthly.
A remembered browser is tied to the person's password and authenticator, so changing either asks every browser again.
Organisations can require passkeys for admins, or for everyone.
Passwords are stored only as salted bcrypt hashes, and sign-in attempts are rate limited.
Sign-ins end after a period the admin chooses, from one to 30 days.

Access is set per module and per role, and checked on the server for every request.
Pay and other sensitive HR details sit behind their own permission.
Each organisation's data is kept apart from every other organisation's.
An audit log records who did what and when, with the address they did it from.

You decide whether Gochi support gets in. Only your admins can let them in, and nobody at Gochi can open your organisation without it.
Your admin picks one of three levels: Show me how (they see your settings screens and point out where to click, but change nothing), Look around (they see everything but change nothing), or Work alongside (they work as you would, except billing).
Even on Work alongside, running scripts on your devices and sending emails or messages to your clients stay off unless your admin ticks them.
Access lasts 24 hours, 7 days or until you end it, whichever your admin chooses.
Below Work alongside, names, email addresses, phone numbers, ID and bank numbers are hidden from them.
The support person signs in with their own two-factor (a passkey or authenticator) just before they open your organisation. No password of yours is ever used.
Every page they open and every change they make is in your audit log, under their own name.
Any admin can press End now at any time, and anyone from Gochi still inside is signed out at once.

Remote desktop works on Windows computers.
Before a technician can see or control a computer, the person signed in to it is asked to allow it. Nothing happens unless they press Yes; No is the default.
While the session runs, a banner across the top of their screen names the technician and has a Disconnect button that ends the session at once.
Every session is end-to-end encrypted between the technician's browser and the computer (X25519 key exchange, AES-256-GCM). Gochi's relay passes on only scrambled data.
Each session is logged on the device's activity, with who started it and for how long. Sessions stop after four hours.
Unattended access (connecting when nobody is at the computer) is not available.

Video meetings in Remote Office are end-to-end encrypted; a browser that can't encrypt can't join.
Meetings run on Gochi's own meeting server in South Africa, not on a third-party video service.
Outside guests wait in a lobby until someone lets them in.

Everything between your browser and Gochi travels over TLS.
Stored passwords for other systems, access tokens, authenticator secrets and integration keys are encrypted with AES-256-GCM.
Signed documents are encrypted where they are stored.
Every page is served with a strict content security policy that changes on every request.

Gochi AI is an optional add-on, switched on per person.
Before text is sent to the AI, the names, email addresses, phone numbers, ID, card and bank account numbers, and passwords in it are masked.
Your data is never used to train AI models.

Gochi is hosted in South Africa, on servers at cloud.co.za.
Every company we pass personal data to, and why, is listed on our sub-processors page.

Read our privacy policy, sub-processors and terms of service. A data processing addendum is available on request.

If you think you've found a security weakness in Gochi, email welcome@gochi.tech. We read every report and will tell you what we did about it.

Start free with every module included. No credit card needed.