Your words stay between you and the person you write to.
Not readable by us, not by the server, not by anyone in between. Here is exactly how, without exaggeration.
Sealed on your phone
End-to-end encryption with the Signal Protocol, using the official, open-source libsignal library: the same foundation as the Signal app. We don't invent our own cryptography.
Every message gets a new key (Double Ratchet). A key stolen tomorrow can't open what you wrote today.
Prepared for quantum computers: new conversations start with a post-quantum key exchange (PQXDH with Kyber-1024, the basis of the new ML-KEM standard).
Sealed sender: our server learns who a message is for, so it can deliver it, but not who sent it.
Voice and video calls are end-to-end encrypted too, and pass only through our own relay in Switzerland, so the person you call never sees your internet address.
Photos, files and voice notes are encrypted on your phone before they leave it.
Nothing that identifies you
No phone number, no email address, no name. You join with a personal invitation code and choose a username. That's all.
No address book upload. Aurisse never reads your contacts.
No advertising, no trackers, no analytics. Aurisse earns its living from circle memberships, not from you.
Invitation only. Circles are closed: nobody can find or message you without having been invited into your circle.
Hosted in Switzerland, not in a US cloud
Our server runs in a data centre in Switzerland, operated by an independent Swiss hosting company: not Amazon, Google or Microsoft.
Swiss law applies: the Federal Act on Data Protection (FADP), one of the strictest privacy laws in the world. We answer only to legally binding orders from Swiss authorities, and even then we can't hand over what we don't have: message content, contacts or names.
The server keeps no logs. No request logs, no IP address history, no record of who talked to whom.
Undelivered messages wait on the server, encrypted, and are deleted as soon as they're delivered, or after 7 days.
Protected on your phone
Your keys and chats never leave your phone in readable form. They're kept in an encrypted database whose key is held by the phone's secure hardware.
No backups to any cloud, and nothing is copied when you move to a new phone: Aurisse forbids it.
App lock with a passcode, fingerprint or face, optionally erasing everything after 10 wrong attempts.
Disappearing messages, per conversation.
No screenshots, no previews in the app switcher, and a keyboard that's asked not to learn what you type.
Your messages travel only to our server, which the app recognises by its pinned key. A fake server, or an intercepting certificate installed on the phone, is refused.
Security codes: compare a code with each contact once, in person or on a call, to be certain nobody is in between.
What we're honest about
Notifications on Android are delivered through Google's push service, as for every Android messenger. A notification carries no sender and no content: Google learns only that something arrived for a device. Your phone then collects the message from our server.
Our server sees some metadata while it works: which member a message is for, when, and the internet address of a connection while it lasts. It doesn't write any of it down.
No independent security audit yet. The encryption itself is the widely reviewed libsignal; Aurisse's own code around it has not yet been examined by an outside firm. We plan to, and will publish the result.
Your phone is part of your security. If someone has your unlocked phone, they can read what's on it. Use app lock.
