How end-to-end encryption works
With end-to-end encryption, the keys exist only on the participants’ devices. The server stores and forwards encrypted data but cannot read it – not even the operator of the service.
This differs from encryption at rest and from transport encryption (TLS). With those, data is protected on disk or on the way, but the server can decrypt it while processing it.
The trade-offs
If the server cannot read content, it cannot process it either. Features that need the plaintext on the server stop working:
- AI features such as transcripts, summaries and translations.
- Server-side full-text search.
- Recordings made on the server.
- Malware scans, previews and server-side integrations.
Key management becomes your job too: if you lose every device and your recovery key, earlier content cannot be restored – by anyone.
End-to-end encryption in Coviqo
From the Business plan, individual rooms can be end-to-end encrypted. Messages, attachments, voice messages, files, notes, whiteboards and the room’s calls are then encrypted on the members’ devices; in calls, audio, video and screen shares are encrypted frame by frame. Direct messages can be switched to end-to-end encryption per conversation.
All other rooms use encryption at rest with a key per space – so that search and AI work. The switch to end-to-end encryption cannot be undone for a room.
Frequently asked questions
Is Coviqo end-to-end encrypted?
Only end-to-end encrypted rooms and direct messages switched to end-to-end encryption. Other content is encrypted at rest per space and in transit, but not end-to-end.
Can I use AI in an end-to-end encrypted room?
No. Transcription, summaries, translations, recordings and server-side search are not available there, because the server cannot read the content.
What happens if I lose my recovery key?
As long as you still have a confirmed device, you can keep reading. If you lose all devices and the recovery key (and passphrase), earlier encrypted content is lost.