No "unhackable" theatre. Just honest, layered protection — and a clear account of what we protect, how, and what we can't promise.
Claims we're willing to put in writing, because they're true.
Message, call and file content is encrypted on your device with the audited Matrix protocol (Olm/Megolm). We don't hold the keys — we can't read it.
Run on a dedicated instance in a jurisdiction of your choosing. Your data doesn't sit inside a Big Tech cloud.
We collect as little as possible — no phone number required. What we don't have can't be leaked, sold, or handed over.
We don't invent cryptography. Matrix is open and independently reviewed — used by governments and militaries.
TLS everywhere, HSTS, security headers, firewalling, fail2ban, automatic security updates and encrypted backups.
Sign-up is token/voucher based, not open to the world — cutting spam and abuse before it reaches your instance.
We never say "unhackable", "100% secure", or "no one can ever access it". Those are marketing lies. Honesty is the point.
Security is defense in depth, not a magic checkbox. Here's the honest picture.
| What | How it's protected |
|---|---|
| Content (messages, calls, files) | End-to-end encrypted (Olm/Megolm) — we don't hold the keys |
| Data in transit | TLS 1.2+/1.3, HSTS, modern ciphers |
| The server | Container hardening, firewall, fail2ban, automatic updates |
| Your identity | No phone number, minimal data, private registration |
| Metadata (who talks to whom, when) | Reduced, but not fully hidden — an honest limitation |
| A compromised user device | We can't protect a phone or laptop that's already infected |
No single control is enough. Protection comes from stacking them.
E2E by default, cross-signing, encrypted key backup and device verification.
Automatic TLS, HSTS preload, and a strict set of security headers (CSP, X-Frame-Options, nosniff, Referrer-Policy).
Third-party trackers and error reporting off, guest access off — nothing phoning home.
Gated registration (tokens, not open sign-up), aggressive rate-limiting on login, controlled federation.
no-new-privileges, database never exposed publicly, isolated volumes, random credentials.
Encrypted off-site daily backups, monitoring, and a written incident-response plan.
Found a vulnerability? We want to hear from you. Report it to security@sovryk.com (see /.well-known/security.txt). We don't take legal action against good-faith security researchers.
Security is a process, not a checkbox — this posture is updated with every infrastructure change.