If your question isn't answered here, contact us.
Every secret is encrypted in your browser, using your organization's key pair, before it's ever sent to our servers - so it travels and sits in our database as ciphertext, not plaintext. The private key needed to decrypt it is itself encrypted at rest on our servers. This isn't a zero-knowledge design: it means GoSecretly's infrastructure is capable of decrypting stored secrets when your organization requests to view them, similar to most secrets-management products. See our Privacy & Data Security page for the full picture.
Yes, for every user, with no way to opt out. It's checked again (a fresh code, on top of your session) before creating a new share link and before viewing a submitted secret, since those are the two most sensitive actions in the app.
You choose an expiry when you create a link (from 5 minutes up to 30 days). Once the recipient submits a secret and you view it, clicking "Got it" permanently destroys it from our database - it cannot be viewed again by anyone, including us.
Yes. An organization admin can invite additional users by email. Two-factor authentication is enforced for every invited user the first time they log in - there's no way to skip it.
A share link is single-use and time-boxed - once submitted and viewed, it's destroyed. All traffic runs over TLS. That said, anyone who obtains a valid, not-yet-used link can submit a secret through it, so treat the link itself the way you'd treat a one-time password: send it through a channel you trust, and only to the intended recipient.
No. We don't collect or store any payment or card information anywhere in the product.
Account basics (name, email, organization), and metadata about requests (timestamps, status, who created or viewed them) for audit purposes. Secret content is always stored encrypted, never in plaintext. See our Privacy & Data Security page for the full picture.