Security that begins with separation.

Security model and scope

M2 is designed for high-exposure or national-security-adjacent operating conditions. That describes the intended operating context—not a certification or government authorization. The model combines independent controls so that a Channel reveals less centralized identity data and ordinary messaging does not rely on a direct clearnet connection to the Gateway.

Identity minimization and compartmentation

Ordinary Channel participation does not require a phone number, email address, real-name account, or global M2 profile. Each Channel establishes its own membership and context. This is an identity-minimizing architecture; it is not a cryptographic zero-knowledge proof system.

Endpoint encryption and local storage

Messages and supported files are encrypted on the device for intended recipients. Local history is protected by the app’s encrypted storage design. The server handles encrypted relay payloads rather than readable communication content.

Attachments and protected files

Attachment protection is applied according to the current verified client behavior. These controls reduce routine exposure and accidental export, while the recipient endpoint remains part of the trust boundary.

Embedded Tor and v3 Onion routing

M2 carries messaging traffic through embedded Tor to a v3 Onion Service. The messaging Gateway therefore does not receive a direct originating clearnet connection from the device. This separation is specific to messaging transport; the public website and other named providers have their own disclosed data boundaries.

Authenticated delivery and deletion

M2 uses a temporary encrypted relay. Authenticated durable receipt initiates server-side ciphertext deletion. If a payload is not delivered, encrypted relay data expires after a hard maximum of 48 hours. Deleted communication content is excluded from the recovery-backup classification recorded for the current service.

Signed update supply chain

The Android app trusts a dedicated release manifest and immutable release objects, separate from this marketing website. A mandatory update must be newer, compatible with the package, match the declared APK SHA-256, and carry the established production signing certificate. Android still presents PackageInstaller confirmation to the user.

Threats the design reduces

• Routine coupling of Channel participation to personal phone numbers, email accounts, and global profiles.
• Readable message content at the relay.
• A direct originating clearnet connection to the messaging Gateway.
• Indefinite retention of undelivered encrypted communication payloads.
• Replacement of the Android release with an artifact that fails package, version, hash, or signer verification.

Boundaries to plan for

M2 does not make a compromised endpoint trustworthy, prevent an authorized recipient from copying information, or eliminate every form of traffic analysis. Tor and endpoint encryption are important controls, but device security and operational discipline remain essential.

Verification status

Operational guidance

• Use a separate system of record when audit, evidence, regulation, or recordkeeping requires retained communication.
• Keep devices patched and protected; a rooted, infected, compromised, or monitored endpoint can expose information at the screen.
• Keep Channels compartmented, avoid mixing personal and operational identities unnecessarily, and avoid long-term reuse for unrelated work.
• Protect invitation material and M2 Codes separately. Minimize sensitive coordination details outside M2.
• Screen capture, external cameras, recipient copying, coercion, and sophisticated traffic analysis sit outside the cryptographic boundary.

Read the M2 Security Whitepaper or review current release evidence.