Enabling End-to-End Encryption

⚠️ Status: Roadmap. The end-to-end encryption workflow described below is the planned design. It is not available in the product today — there is no E2EE toggle in Settings, no shield icon in calls, and no per-channel encryption switch. This article exists to document the architecture we’re building toward so that buyers evaluating sovereignty can review our approach. We will update it when the feature ships.

If you need confidential communications today, Mandraki already protects all data with server-side three-layer envelope encryption and customer-managed keys (BYOK). See creating your organisation for the security settings that are available now.

What End-to-End Encryption Does

When end-to-end encryption (E2EE) is enabled, messages and call media are encrypted on your device and can only be decrypted by the intended recipients. The Mandraki server transports encrypted data without the ability to read it. This provides the highest level of confidentiality for your communications.

Mandraki uses the MLS protocol (RFC 9420) for message encryption and SFrame (RFC 9605) for call media encryption. Both are open, peer-reviewed standards.

Enabling E2EE for Your Organisation

Organisation administrators can configure E2EE at the organisation level.

1. Navigate to Settings > Security.
2. Under End-to-End Encryption, select your preferred policy:
   • Available — E2EE can be enabled on a per-channel or per-call basis by any member.
   • Required — all channels and calls use E2EE by default. Members cannot disable it.
   • Disabled — E2EE is not available. This is necessary if your organisation requires server-side AI features on all communications.
3. Click Save.

Enabling E2EE for a Specific Channel

If your organisation’s policy is set to Available, individual channels can have E2EE toggled on.

1. Open the channel and click the channel name to access settings.
2. Under Security, toggle End-to-End Encryption on.
3. All members of the channel will be notified that E2EE has been enabled.

New messages in the channel will be encrypted end-to-end from this point forward. Messages sent before enabling E2EE remain protected by server-side encryption but are not retroactively end-to-end encrypted.

Enabling E2EE for a Call

1. Before or during a call, click the Shield icon in the call controls.
2. Toggle End-to-End Encryption on.
3. All participants will see a confirmation that E2EE is active.

What Changes When E2EE Is Active

There are important trade-offs to understand when using E2EE.

• AI features are disabled. Transcription, summarisation, and smart replies cannot operate on encrypted content. The server cannot process what it cannot read.
• Server-side search is unavailable. You cannot search E2EE message content from the server. Mandraki maintains a local search index in your browser for encrypted channels.
• Recording is unavailable. Call recordings require server access to media, which E2EE prevents.
• New devices see messages from join point only. If you add a new device, it will receive messages from the moment it joins the group. Historical encrypted messages are not retroactively available on the new device.
• All participants must support E2EE. If a participant’s client does not support E2EE (e.g., an outdated browser), they will not be able to join an E2EE-enabled call or read E2EE messages.

Verifying Encryption

When E2EE is active, a shield icon appears in the channel header or call interface. You can click this icon to view the encryption status, including the current MLS epoch and the list of verified devices in the group.

For additional assurance, participants can compare a safety number derived from the group’s cryptographic state to verify that no unintended devices have been added.