Key takeaways
- Photos, videos, files and voice notes travel over TLS and are stored with AES-256 at rest.
- Each organization's content is encrypted at rest with its own key.
- Attachments follow the access rules of the conversation they were sent in.
- Files can be up to 25 MB each on the current free plan.
- Once someone downloads a file, its protection on their device is up to them.
A site photo with a client’s alarm panel, a scanned contract, a voice note describing an incident: attachments often carry more sensitive information than the text around them. They are also the part of a conversation most likely to be saved, forwarded or opened on a shared computer. This page explains what C Chat protects, how access works, and where your own rules matter.
Short answer: same encryption and access rules as messages
Secure attachments in messaging come down to three questions: how files travel, how they are stored, and who can open them. In C Chat:
- In transit: every upload and download goes over TLS. See how TLS protects messages in transit.
- At rest: files are stored with AES-256, under an encryption key specific to your organization, as explained in per-organization encryption keys.
- Access: a file is visible to the participants of the conversation where it was posted, nothing more.
For the full picture of the encryption design, read how C Chat encrypts your messages.
How attachment security works in C Chat
C Chat supports the attachment types teams use every day:
| Type | Typical use | Notes |
|---|---|---|
| Photos | Damage reports, completed work, site checks | Sent from camera or gallery |
| Videos | Showing a fault or a procedure | Counts toward the 25 MB limit |
| Files | PDFs, spreadsheets, signed forms | Up to 25 MB each |
| Voice notes | Quick reports when typing is impractical | Same protection as other attachments |
| Location | Sharing where you are, once | A message, not continuous tracking |
The secure file sharing feature shows how sending works in the app.
Who can see what
- In a group, every member of that group can open the attachment. Team owners and admins can audit and export it with the rest of the group conversation.
- In a direct message, only the two participants can open it. It is not part of team audits.
- Guests see attachments only in the group they were invited to.
- The platform accesses content only to moderate a reported message or for legal requirements, and that access is logged.
Because C Chat uses auditable encryption rather than end-to-end encryption, group attachments can become part of the team’s record. That is useful when a photo proves a job was done, or when an incident needs evidence.
What it means for owners, admins and members
Owners and admins should decide where documents belong. A practical rule: operational evidence (photos of work, incident pictures, signed delivery notes) goes into the relevant group so it stays on record. Personal documents, such as a payslip question or a medical note, go in a direct message with the right person. The use case on exchanging documents securely in chat gives more examples.
Members should check the conversation before attaching. A floor plan posted in the wrong group reaches the wrong people. When in doubt, send it to a smaller group or directly.
IT and security leads evaluating risk should note what C Chat does not do: it does not scan or block content. If your organization uses data loss prevention elsewhere, chat attachments will not be covered by it automatically.
Honest limits and caveats
- Downloads leave the app. Once a file is saved to a phone or computer, its protection depends on that device.
- Photo metadata. Images taken with a phone can include details such as time or location in the file itself. If that matters, check your camera settings before sending.
- 25 MB limit. Large video or design files need another channel.
- No end-to-end encryption. C Chat can technically decrypt stored content and only does so for reported-message moderation or legal requirements, with logging. If you need a model where the provider never can, compare options carefully.
- Removal is not recall. Removing a member stops future access to group files but does not delete copies they already downloaded.
Getting started
Try it with a real workflow: create a group for one site, post the day’s photos and a voice note, and see how the record builds up. Open getcchat.com/c to start, and check the current plan limits for attachment size and team size.
Frequently asked questions
Are files sent in C Chat encrypted?
Yes. Attachments travel over TLS in transit and are stored with AES-256 encryption at rest, using a key specific to your organization. C Chat uses auditable encryption, not end-to-end encryption.
What is the maximum file size in C Chat?
Up to 25 MB per attachment on the current free plan. Larger files need to be compressed or split, or shared through another system your company already uses.
Can team admins see files sent in direct messages?
No. Files in direct messages are as private as the messages themselves. Owners and admins can audit and export files that were posted in the team's groups.
Does C Chat scan files for sensitive data?
No. C Chat does not include data loss prevention or content scanning. Your team decides what may be shared, and owners and admins can review group content when needed.
Is it safe to send ID documents or contracts over C Chat?
C Chat protects them in transit and at rest, and access follows the conversation. Still, send them only to the people who need them, prefer a direct message or a small group, and remember the recipient can download and keep them.