Lark

Is Lark safe?

Lark is a solid choice on security and a middling one on privacy. ByteDance's Singapore unit holds the usual enterprise certificates, runs a bug bounty, supports two-step login and passkeysPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, and we found no reported breach. Apple's label shows no tracking across other companies' apps. The limits are the ones every work suite has, plus one of its own: your employer controls the data you create, messages are not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, and ByteDance ownership keeps Lark inside the US argument about Chinese apps. We score it 63/100, just below Microsoft Teams (64) and Slack (65), and well above DingTalk (54).

Lark bundles chat, documents, video meetings, email, calendars and approvals in one app. It ranks in the top 100 business apps on Apple's free charts in Singapore, Malaysia, Thailand, Vietnam, Indonesia, the Philippines and Japan.

What Lark collects

The App Store label lists a lot of data linked to your identity: precise location, name, email and phone number, messages, photos, audio, search history, user and device IDs, product interaction and crash data. None of it is marked as used to track you, and the label lists no advertising purpose. On Google Play, the developer says it shares no data with other companies.

The privacy policy, last updated on 1 June 2026, fills in the rest. Lark records metadata such as when you sent a message and to whom, and it scans documents, messages and emails to detect spam, malware and illegal content. Content can feed features that use machine learning. For account recovery in some countries, it may ask for a national ID number and a face image, which it says is deleted after the check.

Data for customers outside the US is stored on servers in the United States, Singapore and Japan, and Lark may share it "globally with companies of our business group". US customers fall under a separate policy. Lark takes part in the EU-US Data Privacy Framework through a US affiliate.

Your employer holds the keys

Like Slack and Teams, Lark is built for organisations, and the policy is explicit about what that means. When you use a work account, your employer is the controller of the data you create and Lark is its processor. Employers can switch on attendance, approval and health-report features, a business directory, third-party integrations and precise location, "including via cell tower triangulation". Lark leaves the legal duty for that data to the employer.

One detail is easy to miss. If your employer closes your work account, Lark converts it into a personal account rather than deleting it. Check what remains there after you leave a job, and delete the account if you no longer need it.

Security and the ByteDance question

Lark lists ISO 27001, 27017, 27018, 27701 and 42001 certificates, SOC 2 Type II and SOC 3 reports, and Singapore's Data Protection Trustmark. Its private HackerOne programme pays the first reporter of a valid bug, and the US National Vulnerability Database lists no CVE for Lark. The weak spot is encryption: Lark says data is encrypted in transit and at rest, and its help pages describe meetings as encrypted, but chats and files are not end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, so the service can read them.

The ownership question is not hypothetical. In a July 2024 court brief, the US Justice Department said TikTok staff used Lark, ByteDance's internal system, to talk directly with engineers in China and to send sensitive data about US users that ended up on Chinese servers. That concerned ByteDance's own internal workspace, not customers' Lark data, and no regulator has accused Lark of mishandling customer data. It does show why companies with sensitive work weigh where Lark's parent sits. The 2024 US law that forced the sale of TikTok covers apps run by ByteDance companies, and in March 2026 9to5Mac reported that Apple was blocking US downloads of several of them, naming Lark.

Lark and Feishu

Feishu (飞书) is ByteDance's version of the same suite for mainland China. It is a separate app from Beijing Feishu Technology, with its own Chinese-language policy, and Apple's China listing links more data to you than Lark's does, including payment information, contacts and sensitive information. We do not score Feishu here.

How to use Lark more safely

1. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary or add a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary in the Account Security Center (Settings, Account and Security).
2. Keep personal chats and files out of a work account; your employer controls them.
3. Give location access only "While Using the App" unless your employer requires check-ins.
4. Do not put secrets in Lark that you would not put in Slack or Teams; nothing is end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary.
5. When you leave a job, delete the personal account Lark creates from your old work account in the Account Security Center.

How we scored it

The regulatory record (84) is the strongest factor: no fine or order names Lark, though no regulator has reviewed it either. Privacy (55) is the weakest, with broad data linked to you, employer-controlled location features and group-wide sharing inside ByteDance. Security (62) gains from audits and a bug bounty but loses for the lack of end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, while scams and harmful content (68) and transparency and control (60) sit in between.