Security — How Kintrel protects conversations
KINTREL
Network: checking… Open web app

Security architecture

Trust the design.
Understand the boundary.

Kintrel combines a client-side cryptographic core with a deliberately untrusted store-and-forward relay. Here is what that protects—and what no messaging app can promise away.

01 Keys

Generated and used on client devices

02 Content

Encrypted before transport

03 Relay

Routes ciphertext, never plaintext

04 Devices

Addressed as distinct secure endpoints

Defense in depth

Four layers. One clear boundary.

TLS protects a network connection. End-to-end encryption separately protects the conversation from the service carrying it.

L1

Identity & device authorization

CTI’s Keycloak realm authenticates accounts. Every linked device has its own registration and public-key material; an account login is not a universal decryption key.

OIDC
L2

Session establishment

Thureos uses X3DH and hybrid PQXDH flows to let clients establish sessions even when the other participant is offline, with authenticated public prekeys and a post-quantum component.

X3DH + PQXDH
L3

Message-key evolution

The Double Ratchet advances one-to-one message keys as a conversation moves. Groups and restricted channels use per-sender key chains and rotate those chains after a member is removed.

RATCHETS + SENDER KEYS
L4

Durable ciphertext delivery

The relay persists an opaque envelope before attempting live delivery, retries safely, and deletes it after device acknowledgement or bounded expiry.

STORE + FORWARD
CLIENT Plaintext Local only
Encrypt
RELAY 9A C4 7F 20… Opaque envelope
Deliver
CLIENT Plaintext Local only

The trust boundary

The server is useful.
It is not entrusted with content.

The server can authenticate a connection, publish public prekeys, validate envelope size and destination, record delivery state, and wake an offline device. For groups and channels, it also holds the plaintext title and roster needed to enforce membership and fan out ciphertext. It does not deserialize or inspect message plaintext.

See the exact metadata categories

The endpoint still matters

Clear controls for the moment content becomes readable.

Transport encryption ends at an authorized device. Kintrel’s local controls make common exposure boundaries visible without pretending an app can control the whole device.

LOCAL AUTH

Sensitive messages relock.

A protected message reveals its content only after fresh device-owner authentication on supported clients. The in-memory grant is revoked on blur or background.

Capability checks refuse delivery to a device that cannot enforce protected-message unlock.
DISPLAY PRIVACY

Inactive screens disclose less.

Desktop’s privacy screen covers an unfocused window. Android, iOS, and Windows add the capture or app-switcher protections their operating systems expose.

Capture exclusion is best effort and cannot stop another physical camera.
CONTENT HAND-OFF

Outside copies are called out.

Opening, sharing, saving, or externally playing a decrypted file asks first by default and names the consequence: Kintrel cannot recall or gate the outside copy.

The reminder is device-local. Separate protected/disappearing open and share refusals remain in force.

Security without theater

Your data. Your device. Your call.

Encryption ends where your device begins.

Once a message is decrypted it lives on your screen and in your storage. A locked device, prompt updates, and careful backups can help keep your data safe at that last step.

Delivery needs a little metadata.

The Kintrel relay never sees your messages or files in plaintext. Routing them takes some metadata, and the relay may log or keep it to protect and improve the service. We never sell that metadata or use it to build advertising profiles.

“Signal-style” describes the design.

Kintrel implements X3DH, PQXDH, and the Double Ratchet in Thureos, our own crypto core, over a custom client-to-server protocol. Independent lineage, same proven cryptography.

Cryptography earns trust through scrutiny.

We name the mechanisms: which primitives run, where keys are generated, and what the relay stores. When the mechanisms change, this page changes with them to keep you informed.

Do your part

Good security is a shared practice.

  • 01 Lock every Kintrel device with a strong PIN, password, or biometric.
  • 02 Review linked devices and remove any one you do not recognize.
  • 03 Download installers only from kintrel.app or an official app-store listing.
  • 04 Treat unexpected sign-in, device-link, and recovery prompts as suspicious.
Get the official app