Private by design — provably, not promise.
Every message and file is sealed with AES-256-GCM, keyed by ECDH on the P-256 curve and HKDF-SHA256. Our deterministic dm_v3 and group_v3 protocols rotate to a fresh epoch every 7 days for forward secrecy, so a compromised key never unlocks the past. Servers in ScyllaDB store ciphertext only — they never hold a key that can read your content.
Interactive preview of End-to-End Encryption
Key benefits
AES-256-GCM authenticated encryption on every message and media file
ECDH P-256 key agreement with HKDF-SHA256 key derivation
Deterministic dm_v3 and group_v3 protocols for direct and group chats
7-day epoch rotation delivers forward secrecy — old keys can't reopen old messages
Servers store only ciphertext; media is client-side encrypted before it reaches S3
Related features
See End-to-End Encryption in action
Get started free and explore all features with your team.