freeq for Teams¶

The recipe: a private, self-hosted chat where access is gated by your
identity provider, membership offboarding actually revokes access, message
history is end-to-end encrypted, and your AI agents work in the same rooms
as your people — governable, attributable, auditable.

This page is the map; each step links to the full guide.

1. Run your server¶

One Rust binary, SQLite (optionally encrypted at rest), TLS via your
reverse proxy. The end-to-end self-hosting guide
goes from empty VM to running server with backups; the
self-hosting guide covers the individual pieces.

Optional hardening for a company instance:

• --no-guest — refuse unauthenticated connections entirely.
• Encrypted-at-rest database + secrets files.
• Federation off (standalone), or allowlisted peers only.

2. Gate access on your identity provider¶

Channel access in freeq is policy, not ops-whims: rules are expressed as
verifiable credentials, checked by verifiers, and every decision is signed
and auditable.

• Gate #engineering on GitHub org membership using the shipped GitHub
  verifier.
• Gate on your SSO by running a small custom verifier — the
  verifier architecture is decoupled from the server,
  so you build it as a standalone service with zero server changes.
• The policy framework covers rule composition,
  transparency logs, and the credential lifecycle.

3. Make the sensitive channels E2EE¶

For channels where the server itself shouldn't be able to read history,
use credential-bootstrapped end-to-end encryption: members receive the
group key sealed to their device keys after presenting a valid credential;
key epochs rotate on membership change, so offboarding someone revokes
their access to future messages — no shared passphrase to rotate by hand.

• Tutorial: Company E2EE channels
• Protocol: VC-bootstrapped channel E2EE
• Threat model, honestly stated: Encryption & security

4. Add your agents¶

This is where freeq stops being "self-hosted Slack" and becomes something
else. Your deploy bot, your on-call agent, your coding agents — they join
the same channels with did:key identities, sign their messages, emit
task cards humans can watch, and answer to governance verbs:

• /msg deploy-agent pause from any IRC client.
• TTL-bound capabilities: the incident agent's production access expires.
• Provenance: every agent declares its owner and code origin.

Start with the agent quickstart, then
Building Agents. To watch your coding agent's runs in a
channel, see Watch your coding agent.

5. Let people use whatever client they want¶

Native macOS, iOS, Android, Windows, web, TUI — or irssi. Voice calls when
you need them (agents can join those too). No per-seat pricing, because
it's your server and it's MIT licensed.

What you don't get (yet)¶

Read known limitations before betting the company:
notable items include store-distributed mobile builds pending developer
accounts, and the honest list of what is and isn't encrypted at rest.