The shortest security review you’ll run this year.
Not because we cut corners, but because there is very little to review. Chalktap never films a room, keeps no recordings unless someone deliberately makes one, and needs no network to write. Sync, Rooms and the assistant are online services; the board itself is not.
Chalktap never films a room: no face sign-in and no video capture, on any platform. The one place a camera appears at all is a phone reading a join code, which keeps no image.
The microphone is used only while someone holds dictation open, or during a narrated replay they started. Never in the background.
Boards are written locally first. A room with no internet is still a room that can teach or meet.
Joining by code needs no profile, no email and no personal data from a pupil or a visitor.
Nine kinds of data, and where each one lives.
If it isn’t in this table, Chalktap doesn’t collect it. There is no analytics on what gets written, no content scanning, and no third-party advertising or tracking of any kind.
| DATA | WHAT IT IS | WHERE IT LIVES | RETENTION |
|---|---|---|---|
| Board content | Strokes, shapes, notes and text: whatever was drawn on the board. | On the display; synced to your tenancy if you enable sync. | Until deleted by a user. |
| Stroke history | The order strokes were made in, which is what replay reconstructs. | Beside the board it belongs to. | Kept with the board; deleted with it. |
| Assistant prompts | The question asked, and the region of the board it was asked about. | Sent to the assistant service to answer; not used for training. | Not retained after the answer. |
| Dictated speech | Audio captured only while the dictation control is open. | Turned into text, then discarded. | No audio is stored, ever. |
| Enquiries you send us | Your name, work email, company, country and anything you type into a form on this website. | Stored in the United States. Used only to answer you. | Kept until the enquiry is closed. |
| Staff accounts | A name, a work email address, and a record of which boards that account made. | With your tenancy, in the region agreed for your deployment. | While the account exists, then a short period for billing and audit. |
| Panel device identifier | An identifier for the display itself, so it can be licensed and kept up to date. It names a panel, not a person. | On the display, and in the licence record we hold for that estate. | While the display is licensed. |
| Crash reports | The fault, the build and the platform, sent when the application stops unexpectedly. No board content. | Sent to our error-reporting processor, named on request. | Kept while the fault is open. |
| Flood protection | A one-way hash of the IP address a form was sent from. Never used to identify, profile or count visitors. | Stored in the United States, apart from the enquiry itself. | Deleted a day after the last attempt. |
Written for rooms with children in them.
Education was the first market and it set the rules the whole product follows. Nothing here changes when the same build is sold into a boardroom.
Pupils join a board with a four-character code. No name, no email, no photograph, no device registration.
Replay only runs when a teacher starts it, shows a live indicator the whole time it’s running, and captures strokes, not the room.
Replays stay with the board by default. Sharing one is a deliberate act by a staff account, it is logged, and a guest can never do it.
Voice is off by default. Turning it on shows the consent wording, “the class is not filmed; there is no camera”, before anything is captured.
The technical answers, up front.
Enough to fill in most questionnaires without a call. If your process needs a signed document, ask and we’ll send the current one.
TLS 1.2 or better for everything that leaves a device, TLS 1.3 wherever the endpoint supports it. Boards are encrypted at rest in your tenancy.
Regional hosting, chosen per deployment. Sync can be disabled entirely for air-gapped estates.
SSO for staff accounts. Guests join by code with no identity at all.
Outbound HTTPS only. No inbound ports, no local server, no agent on the panel.
It sees only the region a person asked about, only when they ask, and can write nothing without an explicit accept.
Panel builds are versioned files you control. Nothing auto-updates behind an estate’s back.
Send us your questionnaire.
We’d rather answer a real form than publish a vague summary. Most come back the same week, and hard questions get a human, not a template.