Passive network observer
TLS, signed packets, message encryption, WebRTC DTLS/SRTP, size buckets, and generic Web Push protect content. Timing, endpoints, traffic volume, and approximate size remain observable.
Post-quantum (honest scope)
PQ is QeyeT↔QeyeT when both peers support ML-KEM-768 + ML-DSA-65. That is not a claim of being ahead of Signal or Proton, and it does not apply to ordinary internet SMTP.
Protected assets
- Message, edit, reaction, receipt, meeting, call-signaling, and file-signaling plaintext.
- File bytes and live audio/video media.
- Account identity private keys, device private keys, skipped message keys, vault key, recovery phrase, and sync/link secrets.
- Contact safety identities, enterprise membership certificates, signed Space manifests, Space secrets, node identities, VAPID private keys, and administrative credentials.
- Availability and integrity of offline queues, prekeys, recovery capsules, and enterprise policy.
Trust boundaries
- Browser endpoint: trusted to display plaintext and hold keys while unlocked.
- Static web origin: trusted to deliver untampered application and WASM code.
- Federation nodes / community relays: untrusted for content confidentiality; trusted only for availability within stated limits.
- Browser push providers: untrusted for content and metadata privacy beyond Web Push encryption.
- Cloudflare / DNS / TLS and VPS: infrastructure trust for code delivery, routing availability, and metadata.
- Enterprise operator: trusted for membership/policy administration, not message decryption.
- Google Drive: optional user-selected storage for an encrypted archival backup.
Adversaries and controls
Malicious or compromised federation node
The node can drop, delay, replay, reorder, selectively route, or measure traffic. Device bindings, packet signatures, ratchet replay protection, recipient checks, delete capabilities, and local downgrade pins protect integrity/confidentiality. Availability and traffic analysis remain residual risks.
Device-key substitution
Every device key object must be signed by the paired identity and pinned locally. Existing device IDs are immutable. Unknown, changed, or unbound keys fail closed.
Replay, reordering, and prekey races
The ratchet handles out-of-order messages and rejects ciphertext replay/tampering. Node key claims are atomic, consumed keys are tombstoned, and request replay returns the original claim response.
Malicious contact or group member
A member can preserve plaintext they legitimately receive, take screenshots, re-share content, flood a group, or compromise their own endpoint. Cryptography cannot revoke already received plaintext.
Malicious enterprise administrator
A tenant administrator can add, remove, disable, or reassign users and cause denial of service through policy changes. The administrator cannot decrypt content through supported control APIs unless it assigns an account it controls as a member and that account is subsequently provisioned.
Browser XSS, extension, or endpoint compromise
This is the highest confidentiality risk. CSP, same-origin assets, escaped dynamic text, no remote cryptography code, dependency pinning, and local kill reduce exposure. They do not protect against a fully compromised origin, malicious browser extension, unlocked OS account, memory inspection, or keylogger.
Supply-chain compromise
Dependencies are exact-pinned with a lockfile and notices. WASM is served locally. A compromised signed dependency or build host remains a residual risk.
Push abuse and SSRF
Subscription writes require a signed account/device and mailbox binding. Endpoints are HTTPS and browser-provider allowlisted. Payload content is constant and encrypted. Provider compromise still exposes endpoint and timing metadata.
Denial of service
Packet size limits, bounded batches, IP and signed-sender rate limits, indexed mailbox lookup, storage quotas, expiry, and bounded community relay storage provide controls. An adversary can still generate many identities or attack infrastructure upstream.
Administrative abuse
Tenant and operator APIs are separate from ciphertext keys. Admins can disable users, alter policy, and cause denial of service. They cannot decrypt content through supported APIs. A stolen administrator token can deny access or replace organization membership, but cannot decrypt retained endpoint history through the recovery flow.
Out of scope for current claims
- Protection after an endpoint has already exposed plaintext.
- Preventing an intended recipient from recording or forwarding content.
- Global traffic-analysis resistance or sender anonymity.
- Hardware-backed key storage and remote attestation.
- Post-quantum on internet SMTP, or any “ahead of Signal / Proton” claim. PQ is QeyeT↔QeyeT when both peers support ML-KEM-768 + ML-DSA-65.
- Guaranteed availability during global infrastructure or browser push-provider outages.
- Legal/regulatory certification such as SOC 2, ISO 27001, HIPAA, FINRA, or FedRAMP.