Security

Built so we cannot read it

Jeioo is end-to-end encrypted by construction, not by policy. Every message, attachment, voice note, reaction and sticker is encrypted on the sending device and can only be decrypted by the devices of the people in that conversation. The server sees, relays and stores ciphertext. There is no “operator view”, and there is no switch that would create one.

The protocol

Conversations — one-to-one and groups alike — are secured with Messaging Layer Security (MLS, RFC 9420), the IETF standard for group end-to-end encryption, through the OpenMLS implementation. Every device you sign in with is its own member of the group, with its own keys; a phone and a laptop never share a secret.

Keys live on your devices

• Each device generates its own long-term signing key and a fresh set of encryption keys; private keys never leave it.
• Adding a device to your account is a key exchange between your devices, not a copy of a secret through the server.
• Your message history is protected by a key derived on your device from your secret word, using Argon2 and the OPAQUE protocol, so that neither the word nor the key is ever sent to us. This is why a lost secret word cannot be recovered by anyone: the design leaves nobody in a position to help.

Forward secrecy and healing

MLS ratchets keys forward with every message and rotates them as members and devices come and go. A key that leaks today does not unlock yesterday’s messages (forward secrecy), and a compromised device is locked out again once the group rotates (post-compromise security).

Key transparency

Every device’s public key is published in an append-only, cryptographically verifiable key directory, built on the Auditable Key Directory design. A server that tried to swap a key to insert itself into a conversation would leave a permanent, detectable trace.

Passwords, sessions and sign-in

• Passwords are stored as salted hashes and never in the clear; the secret word is stored only as a one-way hash for password recovery.
• Optional two-factor authentication with a standard authenticator app.
• Every device has its own session, listed in the app and revocable at any time; session tokens are stored as hashes.
• Sign-ins and sensitive account actions are written to a security log with the address and client used, so a takeover shows.

Transport and the web app

• All traffic runs over TLS (1.2 or newer, 1.3 when the browser can) with HTTP Strict Transport Security, so a browser that has visited once never falls back to plain HTTP.
• A strict Content Security Policy: no third-party scripts, no inline event handlers, no outside origins.
• Cookies are host-locked and secure; every state-changing request carries a CSRF token.
• No content delivery network and no third-party assets: everything the app loads comes from our own server.

Infrastructure

Jeioo runs on a single server we operate, with rate limiting and an intrusion-prevention system in front of it, dependencies kept current, and access confined to one person. Crash reports go to our own crash server on the same machine, with personal data switched off.

What end-to-end encryption does not cover

• Metadata: the server knows who talks to whom, when, and how much, because it has to deliver the messages.
• Your device: an unlocked phone, a compromised operating system or a malicious keyboard can read what you read.
• The other side: the people you write to can screenshot, forward or report what you sent them.
• What you choose to share: an excerpt attached to a report is decrypted for the moderator, and only for them.

Responsible disclosure

If you find a vulnerability, tell us first. Test only against your own accounts, never other people’s data, and never with denial-of-service. Message us on LinkedIn with enough detail to reproduce, give us time to ship a fix, and your name goes on the Hall of Fame — permanently. There is no bounty program yet, only honest credit.

Contact

Security questions and reports: message Jeioo on LinkedIn.