Security

Confidential by design.

NyxTalk runs on your own server. Messages, files and calls are end-to-end encrypted, so the server stores them without being able to read them — and only enrolled devices, with a person holding a security key, can reach it.

  • MLS · RFC 9420
  • UDP 51823
  • TPM · Secure Enclave · StrongBox
  • FIDO2 · YubiKey
  • Ed25519

How a connection is authorised

Five steps, in this order.

  1. A single-use link (72 h by default) handed out by the administrator. The device key is created in the security chip and attested by the manufacturer; the administrator approves it with a 6-digit code compared out loud.

  2. Without the tunnel, the server doesn't exist. Each device has its own tunnel key, renewed every 30 days, plus an additional pre-shared key.

  3. Mutual TLS signed by the device's hardware key. The server checks that the tunnel address really belongs to that device.

  4. Password, then a security key registered on this server (YubiKey PIN and touch). Sessions are limited (12 h by default) and lock after 15 minutes of inactivity.

  5. MLS between the devices of the conversation's members. The server distributes them without being able to decrypt.

Each step is passed in this order. A failure at any one of them stops everything.

End-to-end encryption

Your server can't read your messages.

NyxTalk uses MLS, the IETF standard for group end-to-end encryption (RFC 9420), through the OpenMLS implementation. The server only ever stores encrypted data.

  • Messages: encrypted on the sender's device, decrypted only on the members' devices
  • Attachments: files and images are encrypted too
  • Audio and video calls: encrypted frame by frame with a key derived from the MLS group
  • Search runs on the device, never on the server

What the server still sees

  • Who writes to whom, and when
  • The size of messages
  • Who calls whom, and for how long
  • Call bitrate

What it never sees

  • The content of messages
  • Files
  • Voice and video
  • Shared screens

We write this down plainly because it's the first thing a security officer asks.

Four security levels

You choose at installation.

We recommend Maximum or High. Basic exists so you can start without a hardware key — we'd rather say so than hide it.

MaximumRecommended

YubiKey only

A stolen PC is useless without the key. Default and recommended setting.

HighRecommended

Any certified FIDO2 key

Same protection, free choice of key manufacturer.

Standard

FIDO2 key or Windows Hello

Convenient, but the factor is tied to the PC itself.

Basic

Authenticator app (6-digit code)

To start without a hardware key. A code can be phished; a key can't.

If a device is lost

The administrator revokes it in one click: it is cut off from the tunnel immediately, refused at the next request, removed from conversations, and its local data is wiped at the next launch. The local database is encrypted and stays unreadable without the second factor.

Signed updates

Every release is signed (Ed25519) and verified independently by the server, the host and the app. Windows executables are also Authenticode-signed and timestamped. Devices receive their updates from their own server, through the tunnel.

Zero telemetry

The app talks only to your server, never to a third party. This website follows the same rule: no cookies, no analytics, no third-party scripts or fonts.

Straight talk

What we don't claim.

Credibility is easy to lose. So, to be precise:

  • NyxTalk holds no certification (ISO 27001, SOC 2, ANSSI) to date.
  • The password is still verified by your server: the OPAQUE protocol, which would hide it from the server too, is on the roadmap.
  • The MLS cipher suite is not post-quantum yet; a hybrid suite is on the roadmap.
  • No system is “unhackable”. NyxTalk reduces what can be attacked and what can be read — that's the claim.

Bring your security officer.

We'll go through the architecture with your team, question by question.

Request a demo How security works