04 — Research
The messenger we built for ourselves.
Our products hold conversations people would not repeat elsewhere, so the messaging layer was too important to outsource to something none of us could inspect. We built it on Matrix, run it on tuwunel, and hardened it for the threat that actually matters on a phone: someone else holding it.
Two postures
One of these is right for you. Not both.
Most secure messengers pick a point on the convenience-versus-exposure line and hide the choice. We put it in the settings screen, in plain words, with the trade-off stated.
Standard
Everyday workThe local message store is encrypted with a key derived from your PIN. It unlocks offline, any time. This is the level that protects you when a phone is lost, lent out, or picked up by someone curious.
Maximum
Cleared rolesEverything above, plus a server-held lock. An offline device cannot be opened by anyone. When a phone goes missing or someone leaves, an administrator disables it centrally. The cost is real: unlocking needs connectivity.
What is actually in it
Built for the phone being taken, not the network being sniffed.
Transport encryption is table stakes and every messenger has it. Almost none of them have an answer for the moment the device is in someone else’s hand, powered on, with your session already open.
Keys and encryption
- Message store
- Encrypted with a key derived from the PIN through Argon2id
- Hardware backing
- That key is wrapped by StrongBox, a separate secure element. It is non-exportable — a flashed image of the device does not contain it
- Tokens and proxy config
- Encrypted at rest alongside the messages, not left in plaintext preferences
- In memory
- Keys are evicted the instant the screen goes off. That behaviour is unconditional and not exposed as a setting
Access control
- PIN app lock
- Opening the app requires a PIN, independently of the device lock screen
- Duress PIN
- A second PIN that permanently erases local data instead of unlocking. It looks like a normal unlock attempt
- Emergency notification
- Optionally, entering the duress PIN also alerts a chosen contact with a location. Off by default
- Remote lock and wipe
- An administrator can lock or erase a handset from the server. Commands are server-signed, so they cannot be forged — and the switch cannot be turned off from the phone, because a kill switch the holder can disable is not one
Automatic locking
- USB or ADB data
- A locked phone should only ever be charging. A data connection appearing is usually a tool trying to read the device
- SIM or eSIM removal
- Pulling the card generally means the device has left your control — and is a common way to pre-empt a remote wipe
- Airplane mode
- Same reasoning, one tap earlier. Off by default, since flights and battery saving trigger it too
- Geofence
- Named coordinates that lock the app on arrival — a client site, a venue, anywhere the phone should be inert before it is out of your hands
On screen
- Screenshot and thumbnail blocking
- Suppresses screenshots and the task-switcher preview, which leaks content without anyone opening the app
- Notification privacy
- The lock screen shows neither sender nor message body
- Background grace period
- Optionally keeps notifications alive for a few minutes after switching apps. Turning it off is the stricter setting; screen-off eviction happens either way
Protocol
Matrix, so nobody has to trust us.
Message content is encrypted on the sending device and decrypted on the receiving one. Devices are cross-signed, so adding one is a visible, verifiable event rather than a silent one. The homeserver stores ciphertext it cannot read — including when the homeserver is ours.
Because it is an open protocol, you can federate with partners, restrict federation to an allowlist, or switch it off entirely. And you can leave. That last one is the point: an encryption promise you cannot walk away from is not much of a promise.
An honest note
What none of this solves.
End-to-end encryption protects message content in transit and at rest on the server. It does not hide metadata about who talks to whom and when, it does not survive a device compromised below the app, and it does not stop the person you are talking to from taking a photograph of the screen.
The Maximum posture has its own cost, and we would rather state it than have someone discover it at a bad moment: with no network there is no unlock, and the duress PIN does not take effect either, because it is validated server-side first. The data is intact. It is simply not reachable until the device is online.
Any vendor telling you their product has no such edges is selling something.
Need something like this inside your own organisation?
We built it for our own team, so we know exactly what it cost and where the sharp edges are. Tell us the threat model you are actually working against and we will tell you honestly whether this shape fits it.