The server holds ciphertext it cannot open.

What we hold, and what we cannot read

Solipsis is zero-knowledge by construction, not by policy. The distinction matters: a policy is a promise not to look, and a construction is an inability to.

We store

Ciphertext. Your email address, your public keys, and who belongs to which channel.

We can read

Nothing you write. No message, file, page, spreadsheet or call.

We can see

Metadata: that a message was sent, in which channel, when, and roughly how large.

We can sell

Seats.

The cryptography

Standard, boring primitives, used the standard way. There is no novel cryptography here, which is the point.

Content

XChaCha20-Poly1305. Every message, file and page is sealed with the key of the channel it belongs to.

Key exchange

X25519 sealed boxes. A channel key is sealed individually to each member's public key.

Login

An Ed25519 signature over a timestamp. Your password is never sent to us, in any form.

Device vault

Argon2id stretches your password to unlock the seed stored on that device.

Calls

WebRTC media, encrypted by DTLS-SRTP. Call setup is itself sealed with the channel key.

Every channel has its own random 32-byte key, generated in a member's browser. To add someone to a channel, an existing member's browser re-seals that key to the newcomer's public key. Our servers relay the sealed result and never see the key inside it.

Your identity is bound to your devices

Your master key is random, generated when you sign up. It is not derived from your password, and it is never uploaded.

Your password unlocks the copy stored on the device you are using. That is all it does. A new device cannot be unlocked by your password alone — it is refused until you enter a transfer code, shown to you as text and a QR code from a device you already trust.

What this means during a breach

Stolen credentials — a phished password, a hijacked single sign-on session, an IdP compromise — buy an attacker an authenticated session on their own machine. They do not buy the keys, because the keys are not on our servers to be taken.

It is the reason a Solipsis workspace is a defensible place to run an incident, and the tool your team already uses generally is not.

Removing someone actually removes them

When the owner removes a member, their keys and membership are deleted, and the remover's browser mints a fresh generation of every channel key and seals it only to the people who remain.

Old messages stay readable for everyone who stayed — they keep the earlier generations. The removed member can decrypt nothing sealed after that moment.

Everything that leaves the browser is metadata-only

Features that reach the outside world were built to be structurally incapable of carrying content, not merely configured not to.

• Push notifications say a message arrived in a channel. They never contain the message.
• Outgoing webhooks send a signed event with the channel and the sender's id. No content, no ciphertext, no keys.
• Audit logs record who did what and when. Never what was said.
• Search runs entirely in your browser, against your own decrypted index. Searching is never something we observe.

The limits, stated plainly

Encryption buys specific things and not others. These are the places where Solipsis will not help you.

Metadata

We can see who talks to whom, in which channel, and when. Content is sealed; the shape of your traffic is not.

Recovery

Lose every device and the transfer code, and the data is gone. We cannot reset it — there is no key of ours to reset it with.

Your device

A compromised laptop reads your messages, because you can. End-to-end encryption protects the wire and the server, never the endpoint.

Server-side search

There isn't any, and there cannot be. Search is local, so a very large history costs your browser memory rather than ours.

Audits

No third-party cryptographic audit has been published yet. The primitives are standard and the design is described here in full.

Questions