Matrix-compatible messaging
CallChat uses the Matrix ecosystem for rooms, devices, files, and Element compatibility. Users can use the hosted web client or official Matrix-compatible clients.
Trust centre
Secure by default, clear about boundaries.
CallChat ZERO combines Matrix-compatible messaging, controlled account access, optional Shield vault protection, and a consent-based AI helper. This page explains the user-facing security posture without exposing private implementation details.
Controlled access
Public registration is not treated as a spam-free default. Account access can be reviewed, invited, or token-based as the community grows.
Shield vault layer
ZMath Shield is an optional protected-file and vault layer. Hosted CallChat accounts use the automatic showcase flow; external servers need a licensed module.
AI boundaries
Zero Bot does not need passwords, recovery phrases, Shield materials, signing keys, or private documents. AI output should be treated as assistance, not authority.
Safer downloads
Downloads include checksums where available. Raw build files are kept out of search indexes so users land on the downloads page with context and warnings.
Abuse response
Spam, harassment, illegal content, account abuse, and security concerns should be reported through the abuse route so they can be reviewed quickly.
What not to share
Keep secrets out of chats, forms, and AI prompts.
No support route or bot needs private keys, Matrix recovery phrases, passwords, payment secrets, server credentials, raw Shield material, or proprietary ZMath source. If a message asks for those, treat it as suspicious.
PasswordsNever send them to a room, bot, or contact form.
Recovery phrasesKeep them private and offline where possible.
Private filesUse protected workflows and trusted rooms only.
Security posture summary
- Transport security The public site and Matrix API use HTTPS with hardened response headers.
- Admin access Admin routes are not public navigation targets, are noindexed, and require authentication.
- AI bridge protection The public live-agent bridge has client-side and server-side abuse limits.
- Downloads Release files are served with noindex/noarchive headers and checksum information.
- Voice and video Calls use Matrix/Element WebRTC paths, with TURN support where needed for connectivity.
- Proprietary boundary Premium ZMath implementation code is not placed in public browser JavaScript or public documentation.
Need help?
Use the right route for the right issue.
Use the manuals for setup, the FAQ for product questions, and the abuse route for safety or security reports.