SECRET security

SECRET is designed so that security does not depend on source-code secrecy alone. Its protection relies on cryptography, device-bound keys and server-side verification.

Installation identity

Each clean installation creates a new cryptographic identity and SECRET ID. A normal application update retains the existing identity.

Private keys

The device identity private key is generated and used through Android Keystore and is not intended to leave the device.

End-to-end encryption

Message content is encrypted end-to-end. The server acts as a relay and offline queue and is not designed to decrypt conversation content.

Offline queue

Undelivered encrypted messages may remain queued for up to 7 days, then expire. Delivered items are removed from the server delivery queue.

Limitations

E2EE cannot protect plaintext already decrypted on a compromised endpoint. Root, malware or physical access to an unlocked device can weaken protections independently of the messaging protocol.

Public Preview

SECRET remains under active development. Further audits, infrastructure hardening, modern ratchet work and key-transparency mechanisms are planned before final production release.