Privacy & security
Threat model
Every security product protects against some things and not others. A product that will not tell you which is which is asking you to guess. This page states Keylane’s boundaries explicitly.
Assumptions
Keylane’s guarantees hold only if these are true. If one fails in your situation, the guarantees that depend on it fail with it.
- Your device is not under an adversary’s control while unlocked.
- The app you installed is the one we published.
- The cryptographic primitives used — X25519, ML-KEM, Ed25519, ChaCha20-Poly1305 — are not broken.
- You verify your correspondent is who you believe they are, out of band, before treating a conversation as authenticated.
Adversaries
| Adversary | Outcome | Why |
|---|---|---|
| Passive network observer | Resisted | Payloads are end-to-end encrypted and carried over TLS. The observer learns that you connect to a Keylane relay, not what you send or to whom. |
| Malicious or compromised relay | Resisted | The relay has no decryption keys and holds no sender records. It can delay or drop messages, but not read them. |
| Legal compulsion of Livotov Labs | Resisted | We cannot produce what we do not hold: no message content, no history, no social graph, no identifying account data. |
| Data breach at Livotov Labs | Resisted | Same reason. The maximum loss is sealed in-flight envelopes and destination device identifiers. |
| Retrospective decryption by a future quantum computer | Resisted | Hybrid PQXDH key exchange means recorded traffic requires breaking both X25519 and ML-KEM. |
| Global traffic-analysis adversary | Partial | An adversary observing both endpoints can correlate timing and volume to infer that two devices are communicating. Metadata minimization raises the cost; it does not defeat this. |
| Seizure of a locked device, Keylane locked | Partial | Message content, attachments, and contact details are encrypted with a key that exists only while Keylane is unlocked, and the hardware key protecting it is destroyed on lock, so an extraction recovers ciphertext plus unencrypted timestamps, row structure, and the Keylane identifiers of your contacts. What remains is an offline attack on your PIN, which is why PIN length matters more than any other setting — see client security. |
| Seizure of a locked device, Keylane left unlocked | Partial | The keys are live in wrapped form and the hardware will unseal them for whoever controls the process, so this reduces to the platform’s resistance to forensic extraction and to your device passcode. Locking Keylane on backgrounding removes this case. |
| Seizure of an unlocked device | Not resisted | Messages are decrypted for you to read. Anyone holding your unlocked, authenticated device can read them too. |
| Malware with device privileges | Not resisted | Code running with sufficient privilege on your device can capture plaintext as it is displayed, whatever the protocol does. |
| A correspondent who betrays you | Not resisted | The person you message can screenshot, forward, or repeat anything you send. No protocol prevents this. |
| Coercion of you personally | Not resisted | Keylane has no duress mode. Someone who can compel you to unlock your device gets what your device holds. |
| Adversary who can see you use Keylane at all | Not resisted | Keylane does not obfuscate its traffic or disguise itself as another protocol. It is not a censorship-circumvention tool. |
What Keylane is not designed for
Being direct about this matters more than the marketing cost of saying it.
- Anonymity from a network observer. Keylane hides who you talk to, not that you are online. If your adversary must not learn that you use an encrypted messenger, you need traffic obfuscation Keylane does not provide — consider routing over Tor or a similar transport.
- Plausible deniability under inspection. The app is visible on your device and identifiable in network traffic.
- Protection from your own device. A compromised endpoint defeats every messenger, including this one.
- Guaranteed delivery. Undelivered envelopes expire after 14 days. Keylane is not an archival system.
- Account recovery. Lose every device holding your keys and the identity is gone. This is the direct cost of us not holding your keys — see loss and recovery.
The authentication gap
Encryption guarantees that only the holder of a particular key can read a message. It does not, by itself, guarantee that the key belongs to the person you think it does.
If you accept a contact without verifying their identity through a channel outside Keylane, you are trusting the introduction. Verify safety numbers with people whose identity actually matters to you — in person, or over a channel an attacker would have to compromise separately.
Current status
Keylane is in public beta. Two things follow from that:
- No independent security audit has been completed yet. We intend to commission one and to publish the result in full, including findings that are unflattering.
- Beta software contains bugs, and some bugs have security consequences. If you find one, report it — the disclosure policy sets out scope and safe harbour.
If you are a journalist protecting a source, an activist under state surveillance, or anyone whose safety depends on this being right, do not rely on a single tool or a single vendor’s description of it. Read the whitepaper, weigh the limits above honestly, and combine tools so that no one failure is fatal.
Changes to this document
This threat model is revised as the product changes. Material revisions are noted in the changelog so the history stays visible rather than being quietly edited.