Skip to content

What protects your data — and what does not exist yet

Direct messages are end-to-end encrypted with MLS (RFC 9420) and organisation data is separated in the data layer, hosted in the EU. Enclessa is in open beta, holds no certification and has had no external security audit.

Updated

What the server holdsMLS · RFC 9420

Ciphertext the server cannot read

Keys
1 per device
Server keys
None
Protocol
OpenMLS

Four boundaries

Each layer refuses on its own

Operator plane, no content view

Roles checked in the data layer

Your organisation’s boundary

Keys on each device

Four boundaries, from the operator down to the device.

  1. Layer 1

    Who at Enclessa can see your data

    A separate control plane that can list, suspend and delete organisations but not read content — enforced by a build check, not a policy.

    • Mandatory multi-factor for operators
    • No impersonation, no silent support access
    • Separate platform audit log

  2. Layer 2

    Access control

    Permissions are evaluated in the data layer, so an ungranted capability is absent, not hidden. A role never carries a permission its author lacks.

    • One transferable owner
    • Passkeys and TOTP
    • SAML 2.0 or OpenID Connect SSO, SCIM 2.0
    • Bot tokens scoped to named operations

  3. Layer 3

    Tenant isolation

    The organisation is asserted at one choke point, not at each call site. Another organisation's object answers not-found, because forbidden would confirm it exists. 286 API operations are probed across the boundary; all are refused.

    • Probe suite generated from the OpenAPI document
    • A regression fails the build
    • Files and audit records carry their organisation

  4. Layer 4

    Encryption

    MLS through OpenMLS, compiled once in Rust for every client. Each device is a group member: adding one is visible, removing one re-keys.

    • One key per device, never one per account
    • The server only delivers
    • Encrypted key backup
    • TLS in transit, managed content encrypted at rest

In the product

Permissions you can read, an operator plane that cannot read you

The permission matrix: roles against capabilities

The permission matrix.

Enclessa operators

Metadata only

  • List organisations
  • Suspend an organisation
  • Delete an organisation
  • Write every action to the platform audit log

No way in

  • Read a channel or direct message
  • Open a file or document
  • Sign in as one of your people
Enforced by a build check, not a policy. Operators sign in with mandatory multi-factor.

What Enclessa does not have

Said as plainly as the rest

No certifications
No ISO 27001, SOC 2 or comparable certificate. If one is a gate for you, that is decisive today.
No external audit yet
The cryptographic library is audited; Enclessa's own implementation is not yet. Planned, not finished.
One EU region
No choice of country. Enterprise buys a dedicated deployment in a region you name.
Managed channels are server-readable
Deliberately, for search, retention and export. Match the room to the sensitivity.

FAQ

Security questions

  • It is built for it: EU hosting, a German seller, a data processing agreement, data-subject export, retention rules and legal holds. The lawful basis stays yours.

  • Not encrypted conversations — the server holds no key. The operator plane cannot read managed channels either, and there is no impersonation.

  • Yes: everything, any time, in open formats, with a documented data model and API.

  • Privately to security@enclessa.app. You get an acknowledgement and a timeline.

Bring your team over this afternoon

Free for up to 10 people, with encrypted direct messages and video calls. No payment card, no time limit, no server to run.

For businesses and organisations only — not available to consumers.

Create your organisationCompare plans