Security
Security you can verify, not just trust.
How RavenFlo keeps every conversation private, explained in plain words and documented in full.
Encrypted end to end, by default.
Messages, files, voice notes and calls are encrypted on the sender’s device. Only the recipients’ devices can decrypt them. End-to-end encrypted means readable only on the devices in the conversation. People cannot turn that off.
Keys that never leave the device.
Each device creates its own keys. A lost device is revoked. A new device is added by someone who already has authority. The keys that read a conversation are not sitting in our cloud, because we do not hold the conversation.
Ready for the quantum era.
RavenFlo combines today’s proven encryption with a post-quantum algorithm, so messages recorded today are designed to stay protected even against a future quantum computer. The named suite is published with each release. We do not describe the result as quantum-proof.
Your servers see nothing they don’t need.
Servers handle sealed envelopes, delivery and policy. They do not read the message in order to deliver it. Mobile notifications carry no message content. A push service is asked to wake the device. The text stays on your server until the device fetches the sealed envelope.
Compliance without a backdoor.
A separate compliance copy can be sealed to a key your organisation holds in its own hardware security module. Opening it needs two authorised approvers, and the opening is permanently logged. RavenFlo staff cannot open it. There is no master key, and no quiet way around the two people.
Archive access · AR-204
Statutory audit, FY 2025–26. The archive stays sealed until both approvers agree.
Approved · 10:42
Pending
- Request raised by Internal Audit10:31
- Approved by Meera Krishnan10:42
- Compliance key held in your HSM—
Hardened everywhere.
Encrypted local storage on every device. Apps that are signed and checked for tampering. Connections that are pinned to the certificate you expect. Mutual TLS between servers. These are the ordinary disciplines of a system that assumes the network is not a friend.
Show your work.
Architecture review.
Walk the diagrams with an engineer, against your own deployment.
Book a session →Disclosure.
A public policy for researchers, and security.txt on the domain. A third-party penetration-test summary will be published when a test is complete. It is not published yet.
Policy →Questions security teams ask.
Can RavenFlo read our messages?
No. Messages are encrypted on the sender’s device. RavenFlo staff cannot decrypt them. If you enable a compliance copy, it is sealed to a key your organisation holds. Opening that copy takes two of your approvers. We cannot open it.
What happens if a phone is lost?
The device can be revoked from Control Tower. Its keys stop working for new messages. A new device is enrolled by someone who already has authority. The lost device does not keep receiving the conversation.
What data reaches Apple or Google push servers?
A signal that the device should wake up. The message content is not in that notification. The app then collects the sealed message from your own server.
How do audits work without breaking encryption?
Day to day, an auditor can see policy, device posture and the log of administrative actions. When the record itself is required, two authorised people open the compliance archive. That access is logged. Everyday chats stay encrypted between the people in them.
Which algorithms do you use?
The suite is named with each release and described in the security whitepaper. Messages use end-to-end encryption, with a post-quantum hybrid so a transcript recorded today is designed to stay protected against a future quantum computer. We do not call this quantum-proof.
Read it, then question it.
The whitepaper is public. An engineer will walk the same design on your infrastructure.