Security

How NoChat protects your communications

Security First

NoChat is built from the ground up with security as a core principle, not an afterthought. Our zero-knowledge architecture ensures that your private communications remain private, even from us.

End-to-End Encryption

All messages and calls on NoChat are protected with end-to-end encryption (E2EE). This means:

  • •Messages are encrypted on your device before being sent
  • •Only you and your intended recipients can decrypt and read messages
  • •NoChat servers only see encrypted data that looks like random noise
  • •Even if our servers were compromised, attackers could not read your messages

Cryptographic Standards

We use industry-standard cryptographic algorithms:

Message Encryption

  • •AES-256-GCM for symmetric encryption
  • •P-256 ECDH for key exchange
  • •Hybrid X25519 + ML-KEM-1024 (Kyber) post-quantum key exchange (PQXDH) for direct messages
  • •HKDF-SHA256 for key derivation

Identity & Signatures

  • •ML-DSA-65 (FIPS 204) post-quantum identity & prekey signatures
  • •P-256 ECDSA for digital signatures (classical / legacy)

Video & Audio Calls

  • •WebRTC with DTLS-SRTP encryption
  • •Peer-to-peer connections when possible

Zero-Knowledge Architecture

NoChat operates on a zero-knowledge principle. This means we have designed our systems so that we cannot access your private data even if we wanted to:

  • •Private keys never leave your device unencrypted - encryption and decryption happen locally
  • •No backdoors - there is no master key or special access
  • •Subpoena-resistant - even with a court order, we cannot provide message content because we do not have access to it
  • •Minimal metadata - we collect only what is necessary to deliver messages

Infrastructure Security

Our servers are protected with multiple layers of security:

  • •All network traffic is encrypted with TLS 1.3
  • •Built on open, standardized cryptography and available for independent review (no formal third-party audit completed yet)
  • •Encrypted database storage
  • •Strict access controls and monitoring
  • •Automatic security updates

Auditable & Standards-Based

NoChat is built on open, standardized cryptography — not proprietary black boxes — so our security claims can be verified against public specifications:

  • •Open standards: P-256 ECDH, AES-256-GCM, HKDF-SHA256, and ML-KEM / ML-DSA — no homegrown crypto
  • •Security researchers can review our cryptographic design and primitives
  • •A documented crypto inventory describes every primitive and where it runs
  • •Transparency builds trust

Transparency & Accountability

We believe in radical transparency about how we operate — which includes saying plainly when there is nothing to show yet. Both records below report their real state rather than a promise.

Warrant Canary

Checking…

Transparency Reports

Checking…

Report a Vulnerability

We take security seriously and appreciate responsible disclosure. If you discover a security vulnerability, please report it to us:

security@nochat.io

We commit to acknowledging reports within 48 hours and providing regular updates on our progress toward a fix.

Security Best Practices

While NoChat protects your communications, you can further enhance your security:

  • •Keep your app and device software up to date
  • •Use a strong, unique password if you create an account
  • •Verify contact identities through a separate channel when possible
  • •Be cautious of links and files from unknown sources
  • •Use device-level security features like screen lock and biometrics