Key takeaways
- Direct messages between people are private and are not included in team audits or exports.
- Team owners and admins can audit and export group conversations only.
- C Chat staff access content only for reported-message moderation or legal requirements, and that access is logged.
- Messages travel over TLS and are stored with AES-256 encryption at rest using per-organization keys.
- Privacy does not stop the other person from taking a screenshot, so write accordingly.
Most people assume that anything sent on a company tool can be read by the company. In many products that assumption is correct. C Chat draws a clear line instead: group conversations belong to the team and can be reviewed, while one-to-one conversations between people stay between those people. This page explains where that line sits and where it does not.
Short answer: groups are auditable, direct messages are not
C Chat separates two kinds of conversation. A group is a shared space inside a team, created for a site, a department or a project. A direct message is a conversation between two people. Owners and admins can audit and export the first kind; they cannot audit the second.
This split is the core of what C Chat calls auditable encryption. The business keeps oversight where it needs records, and people keep a private channel for everything else. For a fuller map of every role, read who can read my messages in C Chat.
How private direct messages work in C Chat
You can send a direct message to any C Chat user without sending a request first. There are three ways to find someone:
- By their @username, which means neither of you has to share a phone number.
- Through your phone contacts, using private contact matching where numbers are hashed with SHA-256 on your device.
- From the member list of a team you both belong to.
Every message travels over TLS and is stored encrypted with AES-256 at rest. Being private does not change how a message is protected technically; it changes who is allowed to open it.
Who can see what
| Person | Group conversations | Direct messages |
|---|---|---|
| Members of the group | Yes | Only their own |
| Team owners and admins | Can audit and export | No |
| Security company on CGuard Pro | Groups and security-related chats with guards and office | Only security-related chats |
| C Chat platform | Only reported messages or legal requirements, logged | Only reported messages or legal requirements, logged |
The security-company row is the one exception people should know about. When a guard works for a company that runs CGuard Pro, chats between that guard and the office are work records the company can oversee. Details are on the security company oversight page.
What it means for owners, admins and members
For owners and admins, the practical rule is simple: if a conversation needs to be on the record, move it into a group. Approvals, incident updates, client instructions and handovers belong in groups, where you can later audit and export them.
For members, a direct message is the right place for a sensitive question to a manager, a personal matter, or a quick note that has nothing to do with company records. If you are handling confidential HR or personal topics, see private one-to-one conversations at work.
For HR and compliance, document the split in your internal policy. Employees trust a tool more when they know exactly what is visible and what is not.
Honest limits and caveats
Privacy rules control access to the server copy. They cannot control what the other person does with the message on their screen.
- The recipient can take a screenshot, copy text or forward content elsewhere.
- Messages that contain personal data are still personal data; the glossary entry on PII explains why that matters.
- A reported message can be reviewed for moderation, and content can be accessed when the law requires it. Both are logged.
- C Chat is not end-to-end encrypted. If your threat model requires that even the provider can never decrypt content, compare the trade-offs in auditable vs end-to-end encryption.
Getting started
Open the web app at getcchat.com/c, sign up with your phone number or email, and set an @username so colleagues can reach you without your number. Read the security overview to see the full model before rolling C Chat out to your team.
Frequently asked questions
Can my boss read my direct messages in C Chat?
No. Team owners and admins can audit and export the team's group conversations, but direct messages between two people are private and are not part of that audit or export.
Are C Chat direct messages end-to-end encrypted?
No. C Chat uses auditable encryption: TLS in transit and AES-256 at rest with per-organization keys. Direct messages are private by policy and access rules, and platform access is limited to moderation of reported messages or legal requirements, with every access logged.
What happens if someone reports one of my direct messages?
The reported message can be reviewed for moderation. That is one of the two situations in which the platform accesses content, and the access is logged. Reporting does not give the reporter's employer access to your conversation.
Can I message someone privately without sharing my phone number?
Yes. You can start a direct message by @username, so the other person does not need your phone number. You can also message team members or matched phone contacts.
Does a security company see guards' direct messages?
Security companies using CGuard Pro can audit groups and security-related chats with guards and the office. That oversight is part of how the security workflow is run, so guards should treat chats with the office as work records.