Encryption
Two levels of protection, and you always know which one you are using
By default every kTalk message is encrypted on the server with your company’s key: it can be searched, exported and found on every device. If you need more, the end-to-end extension makes new conversations readable only by the devices of the people taking part.
The conversation’s mode is set when it is born
There is no per-chat switch. Until the end-to-end extension is active, conversations are born “server”: encrypted at rest with AES-256 and a key derived for your company only, the same scheme as Files documents. When the administrator activates the extension, from that moment new conversations are born end-to-end with the MLS protocol (RFC 9420) and carry the “End-to-end encrypted” mark. Existing ones stay as they are: making a chat end-to-end after its messages were readable on the server would give a false guarantee about what was already written.
How it works
-
You start encrypted on the server
Every message is encrypted before it is written to disk, with your company’s key. Anyone copying the database would find unreadable text; members, on the other hand, read, search and export as usual.
-
If needed, you activate end-to-end
The end-to-end extension is activated by the company administrator. From then on new conversations are born encrypted between the participants’ devices, and the server keeps only encrypted text it cannot open.
-
Every device has its own keys
In end-to-end chats you verify a colleague with the safety number, link your computer to your phone with a QR code and turn on the encrypted backup: with the recovery code your history comes back even on a new device.
A chat is born server or end-to-end, and that promise never changes.
What you can do
-
Encrypted at rest, always
Even without the extension no message sits in plain text on disk: AES-256 with a key derived for your company, separate from everyone else’s. Attachments also get a key for each file.
-
End-to-end with MLS
With the extension new conversations use MLS, the IETF standard for group messaging (RFC 9420): keys change when the group changes, and whoever leaves cannot read later messages.
-
Safety verification
You compare a safety number with your colleague, or scan their QR code, and mark them “Verified”. If their keys change, kTalk says so: “Key changed — verify again”.
-
Several devices, linked with a QR code
Computer and phone each have their own keys. A new device is linked by scanning a QR code from one that is already active, or by comparing a number when there is no camera.
-
Revocation, automatic too
A lost phone is revoked from the device list and can no longer read later messages. The administrator can have devices inactive for too many days revoked automatically and set how many devices each person can have.
-
Backup with a recovery code
In end-to-end chats the history lives on the devices. The encrypted backup brings it to a new device with your recovery code: without that code nobody can open it, not even us.
| Feature | Server chat | End-to-end chat |
|---|---|---|
| Messages encrypted on the server | yes | yes |
| Attachments encrypted with a key per file | yes | yes |
| Not even the server can read messages | no | yes |
| Search across all conversations | yes | no |
| Message editing with version history | yes | no |
| Scheduled messages | yes | no |
| Full history on a new device, without backup | yes | no |
| Full conversation export | yes | no |
| Disappearing messages and automatic retention | yes | yes |
| End-to-end encrypted calls | yes | yes |
The mode is decided when the conversation is born and does not change afterwards. End-to-end chats exist only with the extension active.
Frequently asked questions
Are all kTalk chats end-to-end encrypted?
No. All of them are encrypted at rest with your company’s key. Only conversations created after the company activated the end-to-end extension are end-to-end: you recognise them by the “End-to-end encrypted” mark.
Can I make an existing chat end-to-end?
No, and not the other way round either. The mode is fixed when the conversation is born. If you want an end-to-end group, with the extension active you create a new one: messages written before stay in the old chat, with the protection they had.
What do you give up in end-to-end chats?
Everything that requires the server to read messages: search across all conversations, editing messages already sent, scheduled messages, automatic history on a new device (you need the backup or another of your devices) and full conversation export. It is the price of a server that cannot read.
In server chats, who can read the messages?
The members of the conversation. On disk messages are encrypted with your company’s key: the service reopens them to show them to members, for search and for exports made by whoever administers the conversation, which leave a note visible to everyone. A company administrator who is not in the group does not read its messages.
What if I lose the backup recovery code?
The backup can no longer be opened: it is end-to-end encrypted and we do not have the key. If you still have an active device you can link the new one with the QR code, then turn the backup off and on again with a new code.
The other kTalk features
Want to see it with your team?
We show you kTalk with your company’s directory and typologies, in server mode and with end-to-end on, so you decide knowing what you gain and what you give up. Half an hour.
Alex