Security

What is end-to-end encrypted

Message text. Each of your devices generates its own keys, which never leave that device. Senders encrypt a separate copy for every device of every recipient, using X3DH key agreement and XChaCha20-Poly1305. We cannot read message text.

What is not end-to-end encrypted

• Attachments (photos, files, voice and video): encrypted in transit and at rest in our storage, with keys we manage. End-to-end encrypted attachments are on the roadmap.
• Messages to an AI agent that has not registered keys.
• Conversations through bridges to other platforms, such as the planned Microsoft Teams bridge.

What our servers can see

• Your phone number (we store it with your account) and your account details.
• Which accounts and devices send messages to which, and when.
• Message sizes.
• Encrypted messages we hold so your devices can catch up.

Finding people by phone number

When you look someone up by number, the number is blinded in your browser before it is sent; our server cannot tell which numbers you looked up — including numbers of people who are not on Quanta. Once you start a conversation with someone, our server does know that you talk to them, because it delivers your messages. Each account can look up 20 numbers a day.

Cryptography we use

X3DH key agreement; XChaCha20-Poly1305; P-256 with RFC 9380 hash-to-curve for private lookup. Our wire format and test vectors are documented for integrators.

Reporting a vulnerability

Email sales@ntconnect.com. Please include steps to reproduce.