How does Letro's end-to-end encryption work?

Letro encrypts every message or file at the sender's device before it leaves the application. Ciphertext is transmitted securely over communication channels, and only authorized recipient devices receive the material needed to read the content. Signed device identities help confirm who sent a message and which device it came from.

What is the Matrix Protocol?

Letro is built on Matrix, an open source standard for decentralized real-time communication. Matrix defines open APIs for client-server, server-server, application service, identity, and push interactions. It supports end-to-end encrypted messaging using Olm and Megolm, federation by design, and self-hosting options.

What deployment options does Letro offer?

Letro offers flexible deployment options including choosing where data lives based on regulatory requirements, private servers and dedicated infrastructure, isolated and air-gapped options for higher-assurance environments, and federated connectivity allowing separate organizations to retain infrastructure independence while maintaining interoperability.

What enterprise governance features does Letro provide?

Letro provides organization-aware structure to model communications around departments and teams, role-based access control to define permissions, approval and escalation workflows with audit-friendly process design, and governance controls that preserve end-to-end protection for message content.

Protocol & architecture

Encrypted on your device, provable for years

Letro runs on Matrix — end-to-end encryption, verified identities and a timestamped record, hosted in Switzerland.

Request a briefing Whitepaper

Olm · MegolmMessage encryption

TLS 1.3Transport

SwissHosted & resident

10 yrRetention

How a message moves

Four steps, no one in the middle

Your device

Letro homeserver

FED

Their homeserver

Verified device

Encrypted in the app, before it leaves your device

Encrypted on device

Encrypted in the app before it leaves you.

Relayed, not read

Servers carry ciphertext. They hold no keys.

Signed federation

Separate servers authenticate each other.

Opened by recipient

Only verified devices get the keys.

What it guarantees

Three things a regulator can check

Confidential

Only sender and recipient devices hold keys. Letro cannot read your content.

Tamper-evident

Alter an encrypted message and it stops decrypting. Interference is obvious.

Attributable

One passport-verified identity per person, and a signature for every device.

Two layers, not one

Letro encrypts the connection and the content

Transport layer

HTTPS · TLS 1.3

Protects the connection against eavesdropping and tampering. On its own, transport security stops at the server.

Message layer

Olm · Megolm

Protects the content itself, from your device to theirs. It stays encrypted on every server in between.

Letro runs both layers together. Transport encryption on its own would leave readable content sitting on a server — which is why the message layer exists.

Foundation

Built on Matrix, not a closed stack

An open standard for federated, encrypted communication. Inspectable APIs, your own homeserver, no lock-in.

About the standard →Vodozemac audit →

End-to-end encryptionOlm · Megolm

Federation, opt-in per deploymentServer to server

Open standard APIsDocumented

Group rooms and access controlMulti-org

Who else runs Matrix

Public deployments →

NATONI2CE messenger

FranceTchap · state messenger

BundeswehrBwMessenger

German healthGematik TI-Messenger

Assurance

Audited where it counts

Vodozemac auditLeast Authority · 2022

Open specificationOlm & Megolm · published

Letro pen testSeptember 2026 · report under NDA

The cryptography audits cover the Matrix protocol, not Letro. We build on that audited foundation and test our own platform separately.

How it compares

Letro vs Signal

Signal's Double Ratchet is the reference for pairwise encryption. Olm sits in the same family — what differs is everything around it.

Signal

Letro

Pairwise encryption

Double Ratchet

Olm — same ratchet family

Group encryption

Sender keys

Megolm, across servers

Identity

Phone number at registration

Passport-verified PostNumber

Hosting

Signal's own servers

Swiss cloud, or your own

Record

No archive by design

10-year evidential record

Signal is excellent at private personal messaging, and it is not trying to do this job. Letro is built for formal business communication that has to be retained and proven.

Independent testing

Our penetration test, September 2026

In progress, not finished. The report goes to customers and buyers under NDA — findings included, with what we have fixed and what is still open.

Request the report

Deployment

You choose where it lives

Same encryption in every model. What changes is who operates it and where the data sits.

Shared Swiss tenancy, fully encrypted, operated by Letro

ResidencySwitzerland

Operated byLetro

FederationApproved servers

Best forSmall and mid-size firms

Your own homeserver and database, operated for you

ResidencySwitzerland

Operated byLetro, isolated instance

FederationPolicy-controlled

Best forRegulated institutions

Self-hosted on infrastructure your team controls

ResidencyYour data centre

Operated byYour team

FederationExplicit allowlist

Best forPublic bodies, group holdings

Closed network, no route to the public internet

ResidencyIsolated environment

Operated byYour team

FederationNone by design

Best forHigher-assurance mandates

Governance

Enterprise control, encryption intact

01Departments, entities and external counterparts, modelled

02Role-based rights to view, send, approve and administer

03Review steps and escalation paths, audit-friendly by default

04Controls wrap the workflow, never the message content

Discuss your deployment model

30 minutes with our security team. Bring the architecture questions.

Book a demo