01
Keys live on your device
Your private keys are generated on your device and never leave it. The server never sees your private key, cannot decrypt your data, and cannot be compelled to produce plaintext.
00
Cryptography
End-to-End Encryption
Zero-knowledge by design. Server stores ciphertext only.
End-to-end encryption (E2EE) means your data is encrypted on your device and only decrypted on the device of the person you are communicating with. For enveloped content the UltimaOS server only ever sees ciphertext and public keys — it cannot read your messages, mail, files, notes or documents. Calendar events and AI history are not enveloped today.
01
Overview
What end-to-end encryption actually means.
02
Server stores ciphertext only
Chat messages, mail, files, notes, tasks, documents and spreadsheets are stored on the server as opaque encrypted blobs. Backups are encrypted. Calendar events and AI conversation history are stored server-readable today.
03
Compromise is bounded
If the UltimaOS server is compromised tomorrow, the attacker gains access to ciphertext blobs and metadata (who talks to whom, when). They do not gain access to message contents.
02
Details
How UltimaOS implements E2EE.
Every conversation, file and document inside the envelope is encrypted with a symmetric session key derived from an ML-KEM-768 key encapsulation, so for that content the server is a dumb pipe for ciphertext. Calendar and AI history are the documented exceptions.
01
Per-conversation session keys
Each conversation generates a fresh symmetric key. A compromise of one session key reveals only that conversation — never other conversations or the user's other data.
02
Per-file encryption
Files are encrypted with their own random symmetric key, then that file key is encapsulated to each recipient with their ML-KEM-768 public key. Revoking a recipient is a re-encryption, not a deletion.
03
Per-message key encapsulation
When a member joins or leaves a group, the group symmetric key is rotated and re-encapsulated to the new membership. Old members lose access; new members gain it without breaking the rest.
04
Recovery without breaking E2EE
UltimaOS offers optional social recovery based on Shamir secret sharing, which you set up yourself after registration (3-of-5 by default, with 2-of-3 and 4-of-7 presets): a member's encrypted history can be reconstructed with the cooperation of three trusted contacts. Recovery does not weaken the cryptography — it uses secret sharing over the user's encrypted keys.
03
Key points
What this means in practice.
-
01
No admin override
Workspace admins cannot read encrypted content. They can remove members, change roles, and access workspace-level metadata — but they cannot decrypt messages or files.
-
02
Subpoena resistance
A subpoena or court order can compel UltimaOS to hand over encrypted blobs. The encrypted blobs are useless without the user's private key, which UltimaOS does not possess.
-
03
Client-side integrity
Because the server cannot see content, it cannot moderate content. UltimaOS relies on user-driven abuse reports and proactive workspace admin moderation rather than server-side content scanning.
-
04
Inspectable clients
The UltimaOS clients run in the browser, so their code can be inspected directly. Researchers can follow the E2EE implementation end-to-end — from key generation through encrypted transport to local storage — in the delivered bundle. Scoped server-source access for named researchers and audit firms is granted case by case.
04b
References
Standards and references.
- EFF Surveillance Self-Defense ↗ ssd.eff.org
- NIST FIPS 203 (ML-KEM) ↗ csrc.nist.gov
- RFC 8439 (XChaCha20-Poly1305) ↗ www.rfc-editor.org
05
Frequently asked
Questions about end-to-end encryption.
End to end encryption meaning: what does it actually guarantee?
Short answer
End-to-end encryption means the content is encrypted on the sender's device and can only be decrypted on the recipient's — nobody in between, including the provider carrying it, holds a key that opens it. The practical test is simple: if the provider can show you your own content after you lose your device without you supplying a secret, it was not end-to-end encrypted. On UltimaOS, chat, mail, files, notes, tasks, documents, spreadsheets and private boards are inside that envelope; calendar events and AI conversation history are not, and we say so on their pages.
How would you define end to end encryption in one sentence?
Short answer
Content is encrypted on the sender's device and decrypted only on the recipient's, so no intermediary — including the provider transporting it — ever holds a key that opens it.
What is end-to-end encryption?
Short answer
End-to-end encryption (E2EE) is a cryptographic architecture where data is encrypted on the sender's device and only decrypted on the recipient's device. The service provider in the middle stores ciphertext only and has no key to decrypt it. (EFF Surveillance Self-Defense)
Can the UltimaOS server read my messages?
Short answer
No. The server stores ciphertext and the public keys of users. It does not have the private keys needed to decrypt content — it only ever receives ciphertext.
Can UltimaOS staff read my data?
Short answer
No UltimaOS staff member has the technical ability to read your encrypted data. There is no master key, no backdoor, and no override mechanism. This can be verified in the client code, which runs in your browser.
Does UltimaOS use zero-knowledge architecture?
Short answer
Yes. The cryptographic design is zero-knowledge with respect to the server: the server has no information about content beyond opaque ciphertext and minimal metadata needed for delivery.
Can I verify the cryptography myself?
Short answer
The algorithms are NIST-standardized public specifications you can check independently. The client ships to your browser as a standard single-page app, so the code that runs can be inspected directly in developer tools — inspectable today, with signed reproducible builds on the roadmap to make it mechanically verifiable. The backend is proprietary; you can interrogate its behaviour from inside uOS via uAI.
How does E2EE work with AI assistants?
Short answer
AI conversation history is not end-to-end encrypted today: it is readable server-side, because the server assembles the model context. Where you choose an external provider, that provider also processes the context in plaintext at inference time. You pick the model backend, and context is sent per request rather than stored with the provider by us.
What is the recovery model if I lose my device?
Short answer
UltimaOS offers optional social recovery based on Shamir secret sharing, which you set up yourself after registration (3-of-5 by default, with 2-of-3 and 4-of-7 presets). The user designates five trusted contacts; any three can reconstruct the encrypted key material needed to access the user's history on a new device. No single contact can decrypt alone.