Security

Security

Groups.io has operated continuously since 2014. This page summarizes how we protect your groups and your data. Institutions completing a security review can request our detailed documentation; see Security Review Documents below.

Hosting and Data Location

  • Groups.io runs on Linode (Akamai Connected Cloud) in Fremont, California.
  • Files, photos and database backups are stored in Amazon Web Services S3 in Oregon, a separate region from the primary infrastructure.
  • All service data, including backups, is stored in the United States. Some Subprocessors, listed on our Subprocessors page, may process data in other countries.
  • Linode/Akamai and AWS maintain their own SOC 2 Type 2 attestations for the data centers we use.

Encryption

  • Connections to Groups.io use TLS 1.2 or later, with HTTP Strict Transport Security (HSTS).
  • Files, photos and backups stored in S3 are encrypted at rest with AES-256.
  • Passwords are stored as bcrypt hashes, never in plain text.

Account Security

  • Every account can add a second factor: an authenticator app or a passkey.
  • Group owners can require members to use a second factor.
  • Enterprise groups can use SAML 2.0 single sign-on, so your own identity provider controls sign-in and deprovisioning.
  • Changing your password signs out your other sessions, and suspicious sign-ins are detected and flagged.
  • Group owners and moderators have role-based permissions, and their administrative actions are recorded in the group's activity log.

Access to Production Systems

  • No contractors or other third parties have access to Groups.io production systems.
  • Administrative access requires a private VPN, SSH keys and multi-factor authentication.
  • Internal services such as databases are not reachable from the public internet.

Monitoring and Patching

  • Every production server runs host-based intrusion detection and file-integrity monitoring.
  • Alerts reach us 24 hours a day, 7 days a week.
  • Operating-system updates are applied monthly, and critical security fixes as soon as they are available.
  • Every build is checked with static analysis and scanned for dependencies with known vulnerabilities.

Backups and Recovery

  • Databases are backed up continuously to a separate region, with point-in-time recovery over a two-week window.
  • The database runs with a replica, and the application runs on multiple servers behind load balancers.
  • Current service status is published at status.groups.io.

Incident Response

Groups.io maintains a documented incident response plan. If we confirm a breach of personal data, we notify affected customers within 72 hours.

AI and Your Data

Groups.io does not use your data to train AI models, and our AI providers' terms do not permit them to train on the data we send. Ask, a feature that answers questions about a group's message archive, is in a limited test with a small number of groups. When it becomes generally available, each group owner will choose whether to turn it on. Our Subprocessors page lists the AI providers we use.

Privacy and Compliance

Security Review Documents

The following documents are available on request for institutions completing a security or accessibility review:

  • HECVAT 4.1.5 (Higher Education Community Vendor Assessment Toolkit)
  • Information Security Program
  • Incident Response Plan
  • VPAT 2.5 Accessibility Conformance Report (WCAG edition)

To request them, or to send us your institution's own questionnaire, email support@groups.io.

Reporting a Vulnerability

If you believe you have found a security vulnerability in Groups.io, please email support@groups.io with the details. We do not run a bug bounty program.