Glossary · Encryption

End-to-end encryption

End-to-end encryption is a design in which a message is encrypted on the sending device and decrypted only on the receiving devices, so that the server carrying it holds no key that can open it.

Open betaThe platform is being built in the open, so parts of it are not there yet, behaviour changes between releases, and no availability figure is committed while it is in beta. What is still being built.

Also called

E2EE

What End-to-end encryption means

The defining property is not the strength of the cipher but the location of the key. Almost every service encrypts data in transit with TLS and at rest with disk or column encryption, and in both cases the server holds the key — which means the operator can read the content, and so can anybody who compels or compromises the operator. End-to-end encryption removes that possibility by never giving the server a key in the first place.

The cost is that the server loses every capability that depends on reading content. Server-side search stops working, because there is nothing to index. Retention policies cannot inspect what they are deleting. Compliance export cannot produce readable text. Link previews cannot be generated centrally. These are not bugs to be worked around; they are the direct consequence of the guarantee, and a product that claims end-to-end encryption while still offering all of them is describing something else.

End-to-end encryption also says nothing about metadata. Who talked to whom, when, how often and how large the message was remain visible to the server unless separate work is done to hide them, and that work is expensive and rarely complete. A claim of end-to-end encryption is a claim about content only.

How Enclessa uses it

Enclessa end-to-end encrypts direct messages and group direct messages using MLS per RFC 9420. Group channels are deliberately not end-to-end encrypted: they are managed rooms the server can read, which is what makes search, retention and export work on them. Which mode a room uses is fixed when the room is created and displayed in the room itself, so nobody has to guess which guarantee applies.

Where End-to-end encryption is specified

RFC 9420 § 1 — architecture and goals

Related terms

MLS (RFC 9420)MLS, or Messaging Layer Security, is the IETF standard published as RFC 9420 for end-to-end encrypted group messaging, designed so that adding or removing a member costs work proportional to the logarithm of the group size rather than to the group size itself.Read the entry Managed channelA managed channel is a room whose contents the server can read, which is what allows server-side search, retention rules, audit trails and organisation-wide export to operate on it.Read the entry Room modeA room mode is the fixed property of a conversation that decides whether the server can read its contents, chosen when the room is created and never changed afterwards.Read the entry Forward secrecyForward secrecy is the property that compromising a key today does not allow the messages sent before that compromise to be decrypted, because the keys that protected them have already been destroyed.Read the entry Zero-knowledgeZero-knowledge is a term from cryptography for a proof that convinces a verifier a statement is true while revealing nothing else, and it is also used loosely in marketing to mean that a provider cannot read customer data — two things that are not related.Read the entry OpenMLSOpenMLS is an open-source implementation of the MLS protocol written in Rust, developed in the open by contributors from Phoenix R&D, Wire and Cryspen, and subjected to external security review.Read the entry

Read further

The security page explains how Enclessa protects data and which certifications it does not hold. The trust centre covers the processing agreement, the subprocessors and the residency position. The FAQ answers the questions buyers ask most often.

Encrypted collaboration, hosted in Europe.

Create a workspace in a couple of minutes. It is yours at your-team.enclessa.app, hosted in the European Union, with encrypted direct messages from the first one you send.

Create your workspace See pricing

Open beta. Free plan, no payment card to start.