Encryption layers
- End-to-end (application layer): Message content and attachments are encrypted on the sender's device and decrypted only on recipients' devices, using the Matrix protocol's Olm and Megolm. Olm secures one-to-one sessions and is an implementation of the Double Ratchet — the same family as Signal's algorithm. Megolm extends this to encrypted group rooms and multi-device use; group messages derive an AES-256 content key and an HMAC-SHA-256 authentication key.
- Transport: Client–server traffic runs over TLS 1.3. Server-to-server (federation) traffic uses HTTPS plus public-key signatures at both the TLS and HTTP layers. Transport encryption protects the path; end-to-end encryption protects the content itself.
- At rest on the server: The homeserver stores ciphertext for content, plus the delivery and audit metadata described below.
- At rest on devices: Data on your device is encrypted using AES-256-GCM, protected by the device's secure enclave (Keystore on Android, Keychain on iOS).
Keys
Private keys are generated on the device and never leave it. Letro's servers distribute public keys and one-time pre-keys so that devices can establish sessions; Letro cannot access private keys. Olm sessions ratchet keys with every message, giving forward secrecy and post-compromise security for pairwise sessions; Megolm session keys are rotated according to Matrix's rotation rules.
Device verification
Users can verify each other's devices so that only trusted devices are in a room. Verification is part of the Matrix trust model and is exposed in the Letro apps.
What the homeserver can see
Honest answer: some metadata. The homeserver — and its administrators — can see which users are members of which rooms, and the timing of events. This is by design: it is what allows Letro to produce timestamped, tamper-evident delivery records for regulated workflows. It does not weaken the encryption of content. Letro does not use metadata-hiding techniques such as sealed sender; it is not a Signal-based product.
Audits
The audits are of the Matrix protocol, not of Letro. Matrix's cryptography is openly specified; its Rust implementation, vodozemac, was independently audited by Least Authority in 2022; and published formal analysis has modelled authentication, confidentiality, forward secrecy and post-compromise security for Olm and Megolm. An independent penetration test of Letro itself is scheduled for mid-September 2026; the report will be available to customers under NDA.
