How we protect your conversations
What encryption really protects, which metadata remain visible, and where the limits are.
This page explains, without too much jargon, what Orizon protects and what it does not. We would rather be precise about the limits than vague about the promises.
How it works
Every message is encrypted on your device before it leaves, and can only be decrypted on the device of the person receiving it. The keys needed to read it are created on the devices and never leave your phone or your browser.
Our server delivers messages; it does not read them. Even someone with physical access to the machines would find nothing but encrypted text.
Checking who is on the other side
Encryption protects the content, but on its own it does not guarantee who you are talking to. That is why Orizon lets you verify devices: by comparing a sequence of emoji or scanning a code, you can be certain you are really talking to the right person and not to someone who has slipped in between.
It is the step almost nobody takes, and the one that matters more than any other.
What the server sees anyway
No messaging system can hide metadata entirely, and anyone who claims otherwise is oversimplifying. Our server knows:
- which accounts take part in a conversation;
- when exchanges happen and how often;
- the approximate size of the content;
- the IP address you connect from, kept for thirty days at most.
This information is needed to deliver messages. We keep it for the minimum time necessary and do not use it to build profiles.
The limits you should know
If your phone or computer is compromised, encryption does not help: messages are read before they are encrypted.
The recipient can take a photo of the screen, copy the text or show it to others. No technology can prevent that.
If you enable key backup, its security depends on the strength of the recovery phrase you choose.
When the apps arrive, the wake-up signal will pass through Google and Apple services. Those services know you received something, not what you received.
If you lose access
We do not keep a copy of your keys, so we cannot recover your conversations for you. It is the other side of end-to-end encryption: nobody can read them, not even to help you. That is why it is worth enabling key backup and keeping your recovery phrase safe.
Verifiable, not just stated
The code that performs the encryption is public and can be read on the Source code page. We do not ask you to take our word for it: we put you in a position to check, or to have someone with the right skills check for you.