The problem
Private by policy is not private
Four checks
Board and works-council communication, in order
Start a group direct message rather than a channel
Group direct messages are always end-to-end encrypted. This is not a setting somebody could have failed to switch on, and not something an administrator can change afterwards — there is no mechanism, in the product or in the database, to make a group direct message readable by the server.
Check what the room says it is
A room’s mode is fixed when it is created and displayed in the room itself, so nobody has to take it on trust or infer it from a settings page.
Understand who can join, and who cannot
Membership of an encrypted conversation is membership of a cryptographic group, so adding somebody is a visible event to everybody in it.
Keep the searchable half where it belongs
Use ordinary managed channels for the work that has to be searchable, retained and exportable, and keep the confidential discussion in the encrypted room.
The specification
What the encryption is
- Encryption
- MLS per RFC 9420, through OpenMLS
- Group direct messages
- Always end-to-end encrypted, with no exception
- Administrator override
- None. There is no mechanism to add one
- Keys
- One per device; the server runs delivery and holds no keys
- Room mode
- Fixed when the room is created and shown in the room
Which plan this needs
None in particular. End-to-end encrypted direct messages and group direct messages are on every plan including Free, which means a works council or a board can use this without a purchase decision and without the organisation paying for their confidentiality.
Compare plansWhat it will not do
The limits, before you find them
- Group channels are managed by default: server-readable, which is what makes their search, retention and export possible.
- A room cannot be switched between encrypted and managed after it is created.
- An encrypted room has no server-side search, no compliance export, no bots and no webhooks.
- Losing every device in an encrypted conversation loses that history.
FAQ
Board and works-council communication: questions
- No. Group direct messages are always end-to-end encrypted with MLS per RFC 9420, there is no administrator override, and the server holds ciphertext it cannot decrypt. Adding somebody to the conversation is a visible event to everyone already in it.
- The confidentiality property a works council needs — communication the employer cannot read even though the employer pays for the platform — is what an end-to-end encrypted group direct message provides. Whether that satisfies a particular works-council agreement is a question for the parties to it, not one this page can answer.
- Because a channel is usually where search, retention rules and compliance export have to work, and all three need the server to be able to read the message. An organisation can permit end-to-end encrypted channels for the conversations where confidentiality matters more; they are chosen when the channel is created, and Enclessa’s own implementation has had no external audit. Each room shows which kind it is.
Bring your team over this afternoon
Free for up to 10 people, with encrypted direct messages and video calls. No payment card, no time limit, no server to run.
For businesses and organisations only — not available to consumers.