IT emergency?
DEEN

Security

What is protected – and where the protection ends.

The cryptography of Silvra Messenger listed in full, the limits of the protection, the legal framework, how to report a vulnerability – and what this website does with your visit.

InventoryAs of October 2026

Every building block, with standard and status.

The classical building blocks are listed here too – not in a footnote.

  • 1 Post-quantum, hybrid
  • 2 Symmetric, 256-bit
  • 2 Classical
  • 3 Not end-to-end
Table 1 · Cryptography inventory, Silvra Messenger
Building blockMethodStandardStatus
Key exchangeX-Wing (X25519 + ML-KEM-768) in MLSFIPS 203 · RFC 9420 · X-Wing (IETF draft)
Post-quantum, hybridHybrid: if one scheme breaks, the other holds.
Message contentChaCha20-Poly1305RFC 8439
Symmetric, 256-bitGrover’s algorithm halves the effective key length from 256 to 128 bits — still enough.
AttachmentsAES-256-GCM, one key per fileFIPS 197 · SP 800-38D
Symmetric, 256-bitThe file key travels inside the encrypted MLS message.
Sender signaturesEd25519 (in MLS)RFC 8032
ClassicalConcerns authenticity, not the confidentiality of stored messages.
Voice and video callsWebRTC, DTLS-SRTPRFC 5764
ClassicalEncrypted, but with classical schemes.
Updates feed——
Not end-to-endA broadcast to contacts; posts are stored in plain text on the server.
Messages before encryption is set up——
Not end-to-endUntil a chat is encrypted, for instance because the other side has not yet stored any keys, messages go to the server unencrypted. The app shows this in the chat.
Profiles, groups, polls and events——
Not end-to-endThe server can read display names, pictures, group names, members, roles, polls, events and reactions – in encrypted chats too.
Table 1 · Cryptography inventory, Silvra MessengerSource: the team’s own information (source code not public) · As of October 2026

Cipher suite of the MLS groups

MLS_256_XWING_CHACHA20POLY1305_SHA256_Ed25519

Limits

What the server sees – and what is only classically protected.

End-to-end encrypted does not mean a server knows nothing. This is what it knows.

Readable for our server

  • Messages before encryption is set upUntil encryption has been set up in a chat – for instance because the other side has not yet stored any keys, or setting it up failed – messages go to our server unencrypted. The app shows this in the chat.
  • Posts in the Updates feedNot end-to-end encrypted: posts, comments and reactions are stored as plain text on the server.
  • Profiles, groups and pollsDisplay name, profile picture, profile text and status; group name, description, picture, members and roles; polls, events and reactions – in encrypted chats too.
  • Account and deliveryYour email address, your signed-in devices, when you were last online, who writes to or calls whom and when, and the addresses of shared links whose preview the server fetches.

Only classically protected or limited by design

  • Voice and video callsRun over WebRTC with DTLS-SRTP — encrypted, but with classical methods.
  • Sender signaturesEd25519 — a classical scheme. Recorded messages stay protected by X-⁠Wing; a future quantum computer could, however, forge signatures and actively insert itself into a group.
  • Old messages on a new deviceA newly signed-in device cannot read past encrypted messages. This follows from the protocol: a new device joins an MLS group only from the moment it is added and receives no keys for earlier epochs.

Jurisdiction and operation

Where Silvra works – and where that is documented.

European law, no business with data, open building blocks.

Jurisdiction and operationAs of October 2026
Development
EU
Legal framework
EU law, including the GDPR
Server
in Germany, run by Silvra itself – no hosting providerPrivacy policy of the app
Processors
Google (push notifications), Resend (emails with the sign-in code), Cloudflare (relaying calls)Privacy policy of the app
Advertising
nonePrivacy policy of the app
Usage data
never resoldPrivacy policy of the app
Source code
not public · building blocks OpenMLS and libcrux open

Reporting

Report a vulnerability

Found a vulnerability in Silvra Messenger or on this website? Please report it privately – before you publish it.

How to proceed

  1. Write to info@silvra.net with the subject “Security”.
  2. Describe what is affected and how the finding can be reproduced.
  3. Please do not test with other people’s accounts or data, and publish nothing before the vulnerability is fixed.
  4. We confirm receipt, check the finding and let you know once it is fixed.
Report a vulnerability

Machine-readable: security.txt

Contact details for security researchers are also in the security.txt file following RFC 9116. It is written afresh with every build, with a new expiry date.

/.well-known/security.txt

This website

What silvra.net does with your visit.

Almost nothing – and that is fixed in how the site is built, not merely promised.

Operating data of this website
Cookies
none
External resources
none – fonts and images come from silvra.net
Tracking
none, no analysis of usage behaviour
Content Security Policy
default-src 'self' · form-action 'none'
Hosting
own server in Germany
Accessibility
WCAG 2.2 AA · checked 14 Oct 2026

Privacy (website)