End-to-end encryption: who can read your messages, and who cannot
End-to-end encryption (E2EE) means data is encrypted on the sender’s device and can only be decrypted on the recipients’ devices. The service in between stores and forwards it but does not hold the keys, so its operators, and anyone who breaks into its servers, see only ciphertext.
End-to-end, in transit, at rest
Three phrases appear on almost every product page, and they promise different things:
- Encrypted in transit: protected on the network between your device and the server. The server decrypts it on arrival.
- Encrypted at rest: stored encrypted on disk. The server holds the key and can read it when it needs to.
- End-to-end encrypted: only the endpoints hold the keys. The server cannot read the content at any point.
What end-to-end encryption does not hide
E2EE protects content. It does not usually hide metadata: who sent something, to which group, when, and how large it was. It does not protect a phone that is unlocked and left on a car seat. And a feature that needs the server to understand the data, such as an alert when someone enters a danger zone, cannot work on data the server cannot read. Every honest system draws a line somewhere, so ask a vendor to show you where theirs is.
A photo from a search
A searcher photographs a jacket found by a stream and sends it to the team chat. The phone encrypts the photo with keys that only the team members’ devices hold. The server stores and forwards the ciphertext; it knows a file of 2.1 MB went to that chat at 15:42, but not what is in it. If the searcher’s phone is later lost, it is revoked from another device and stops receiving anything new.
Where Sinkaos uses end-to-end encryption
End-to-end encrypted
Messages, photos and files. The server sees that a message was sent, by which device, to which channel, when, and its size.
Encrypted in transit and at rest
Incidents, tasks, map objects and positions. The server reads them so it can sync between devices and sites and raise alerts.
Keys on each device
Every phone and browser has its own key pair; the private key never leaves it. Lost devices can be revoked.
No hidden access
Search inside encrypted messages runs on your device. If an organisation needs compliance access, it appears as a visible member.
Questions about end-to-end encryption
Is everything in Sinkaos end-to-end encrypted?
Do WhatsApp and Signal use end-to-end encryption?
Does E2EE make a system compliant with the NIS Regulations or UK GDPR?
Try it on your next operation.
Early access is free. We set up the first operation with you and stay close while you use it.