How faast protects your messages, what our servers keep and for how long, and where the limits are. This page describes the app as it works today, 21 October 2026.
End-to-end encryption
Every chat in faast, one to one or in a group, is encrypted end to end with MLS (Messaging Layer Security, RFC 9420), the IETF standard for group messaging. faast uses the open-source OpenMLS library.
Each device you use is its own member of the conversation, with its own keys. Messages are encrypted on the sender's device and decrypted on each recipient device. Our servers only ever handle sealed envelopes.
| Part | Algorithm |
|---|---|
| MLS ciphersuite | MLS_128_MLKEM768X25519_AES256GCM_SHA384_Ed25519 (post-quantum) |
| Key exchange | ML-KEM-768 (FIPS 203), with X25519 as a second lock |
| Message encryption | AES-256-GCM |
| Hash | SHA-384 |
| Signatures | Ed25519 |
| Photos, files, voice messages, backups | AES-256-GCM |
Post-quantum
faast uses post-quantum key exchange. Chats between people run on the suite above: ML-KEM-768, the NIST post-quantum standard (FIPS 203), with X25519 as a second lock. An attacker has to break both, and messages recorded today stay closed even if a large quantum computer appears later. Existing chats were moved to it automatically.
Still on the classic suite (MLS_128_DHKEMX25519_AES128GCM_SHA256_Ed25519, solid against today's computers): channels and the chat with yourself, which move next, and chats with the few devices that have not updated yet. The suite's number is still provisional in the IETF draft; when the final one is assigned, groups are rebuilt with it.
Real-time typing
When live typing is on, the text you are writing travels as encrypted MLS messages, exactly like a sent message. The server cannot read drafts any more than it can read messages. Turn it off for a chat with the ⚡ button.
What our servers store
| Data | Stored? | For how long |
|---|---|---|
| Sealed message envelopes | Yes, encrypted | Until every device of the recipient has them, 30 days at most |
| Who writes to whom, when, message type and size | Seen to deliver messages | |
| Your address book | No: matched in memory, never written down | |
| Encrypted photos, files and voice messages | Yes, encrypted | No expiry; videos are deleted after 90 days |
| Encrypted backup of your history | Yes, encrypted | No expiry |
| Account: phone number, name, profile photo | Yes | While the account exists |
| Push tokens of your devices | Yes | While the device is registered |
Notifications
The content of a message never passes through Google or Apple. On Android, Firebase Cloud Messaging carries only an envelope id and a hash, as a silent wake-up. On iPhone, Apple's push service carries the words "New message" and the envelope id. In both cases the phone then downloads the sealed envelope from our server and decrypts it on the device.
Backups
History backup is on by default. There are two ways it can work:
- Without a password. The backup is encrypted, but we keep its key in escrow, itself encrypted with a server key. This is what lets an SMS code restore your history on a new phone. It also means we could open it.
- With a password. The key is derived from your password (PBKDF2-SHA256, 310,000 iterations) and the backup is encrypted with AES-256-GCM. We never see the password. If you lose it, nobody can open that history, us included.
We suggest a password. We don't force it.
Tor
The Android, iPhone and Windows apps include Tor (the Arti client). Turn it on and your traffic travels inside the Tor network all the way to our onion service, with no exit node in between. Our servers then see a Tor connection, not your IP address.
Tor does not make you anonymous: your account is your phone number. Voice and video calls do not go through Tor.
Dana, the assistant
Dana is a member of your chat with her, so that chat is end-to-end encrypted up to her, and she decrypts it on our server to answer. She cannot see your other chats, except one you ask her to sum up.
Her built-in brain is an open model running on our own machine in Europe. If you add your own key for another AI provider, the texts you give Dana go to that provider and its rules apply.
Your devices
On Windows, faast seals its MLS state on disk. On Android, iPhone and the web, the local copy of your chats relies on the protection of the device and the browser: use a screen lock and keep the system's storage encryption on.
Our servers
Our servers are hosted by Interserver in the United States. The API is reached through Cloudflare, which terminates the TLS connection: it sees requests and sealed envelopes, never message content. Encrypted attachments are stored in Cloudflare R2.
Reporting a problem
Found a security issue? Please tell us before telling the world, so we can fix it first. The contact address is on the Contacts page.