Cryptographic Architecture: Why Looking Is Impossible
Security is rooted in cryptographic guarantees and mathematical proof, not vague promises in a privacy policy.
Guarantees That Survive Company Shutdowns
Even in the event of complete server compromise, an attacker obtains nothing but pseudorandom bytes. Every line of code is open source and auditable on GitHub.
Key Derivation & Encryption
Session keys derived via Argon2id & X25519. All responses and notes are encrypted locally before touching the network.
Zero-Knowledge Storage
The server only receives and stores opaque ciphertext blobs. Operators and DBAs have zero ability to decrypt.
Authorized Decryption
Only the designated 1:1 counterparty with their verified private key can decrypt and read the notes.
Your data. Your infrastructure. Verifiably private.
For a corporate buyer, “trust us with your employees’ most sensitive conversations” is a hard sell from any vendor — and it should be. encrypted1on1 is built so that sentence never has to be the pitch.
Self-hosted.
The entire platform runs on infrastructure your company controls — your servers, your cloud account, your backup policy. No data ever has to leave your organization’s boundary unless you choose the Cloud option.
Open source (AGPLv3).
Every line of code — including the cryptography — is public and auditable. You, or an independent security team you hire, can verify the privacy claims directly instead of taking a vendor’s word for it. That’s a materially different trust model than a closed-source SaaS product asking you to trust its unread source code and its Terms of Service.
End-to-end encrypted, specifically.
1:1 content — answers, feelings, feedback, comments, meeting outcomes, goal progress — is encrypted in the browser before it ever reaches the server, with keys derived from each user’s own password and never transmitted. The server stores ciphertext. It cannot decrypt it — not the operator, not IT, not us, not an attacker who compromises the database. The two deliberate, narrow exceptions: (1) a goal’s title, description, and status are stored as plain text specifically so goals can support company-wide alignment and light reporting, and (2) custom company templates (template names, descriptions, and question definitions authored by admins, plus which template version a meeting references) are stored unencrypted so teams can share meeting structures. Answers to all questions, feedback, private notes, and goal checkpoints remain strictly private to the two participants, full stop.
This is the resolution to the exact problem in the origin story above: a vendor shutting down, being acquired, or having a bad actor on staff no longer matters to the confidentiality of what’s already been written, because there was never a point where the vendor — any vendor, including us — could read it.
“What about legal holds, harassment investigations, or compliance requests?”
No, and that’s deliberate — because the alternative defeats the purpose. If a company could read 1:1 content, the conversations that most need to happen honestly would stop happening at all. The scenario compliance teams should actually worry about: an employee needs to report concerning behavior by their own manager, or by someone above their manager. If that person — or anyone in their reporting chain — could read 1:1s, would the report ever get written down truthfully? Confidentiality isn’t in tension with catching real problems. It’s the precondition for them surfacing in the first place.
And practically, this isn’t a dead end. Every 1:1 is readable by exactly its two participants, independently — never through a single shared company key. If an investigation involves one participant, the content remains available through the other one, the same way it would if the same conversation had happened on paper or in a personal notebook: legal process can compel a person to produce what they have. It was just never something a platform could hand over on its own, which is the entire point.
Deploy On-Premises in 2 Minutes
A single self-contained container, zero external SaaS dependencies, and full control over your organization’s sensitive data.
docker run -d -p 8080:8080 --name e1o1 ghcr.io/aleksejs1/encrypted1on1:latest AGPLv3 • Unlimited team members • Zero tracking or telemetry