We start where they DON'T go
A detail of Solo2 that goes unnoticed the first time it is used, but which is the biggest difference with the messaging you use every day: your messages do not go through our servers.
In the most widespread messaging today, when you send something to someone, that message travels through the servers of the company that provides the service. The content is usually encrypted, yes, but the message is physically there: passing, being copied along the way, sometimes being saved for a while until the recipient connects. Not in Solo2. What you write travels directly from the writer's device to the reader's device. No stopover, no copy, no intermediate step.
Why does that already protect you?
What is on other people's servers — even encrypted — is something that exists. It's there. Under legal pressure it can be requested, in the event of a future breach it can be leaked, with time and resources it can be analyzed. At Solo2 we can't give anyone something we never had.
That's Solo2's first layer of security, and most people have enough of it. The usual threats — a compromised service, a court order on the company, a massive vendor breach — don't affect us: there is no information to ask for, filter or analyze.
And then, why do we encrypt?
There are scenarios in which architecture alone is not enough. If there is a program residing on your own device monitoring what goes out, if the network you travel on is under surveillance by an actor with many resources, if someone has the ability to analyze traffic patterns on an industrial scale — that's where the layers of encryption come in.
They are not for the occasional thief or to protect you from yourself. They're for when what you send matters enough that someone with the time, resources, and motivation wants to read it. The journalist with a source, the lawyer with a sensitive case, the doctor with patient data, a negotiation under NDA. For those scenarios — and for anyone who prefers not to have to think about whether their conversation is one that matters — Solo2 encrypts two things: the content of the message and the sending data.
A new key for each postcard
Imagine for a moment that sending a message was sending a postcard. Every time you write one, Solo2 encrypts it with a unique key that is generated for that sending. As soon as we use it, the key is destroyed. If someone managed to steal the key from a postcard, they would only be able to read that one — not a single one more, neither backwards nor forwards. Cryptographers call this forward secrecy, and it is the gold standard of modern private messaging., "olvido perfecto", y es el estándar de oro de la mensajería privada moderna.
A new key also for the envelope
The postcard never travels alone: it goes inside an envelope with its shipping information — who it is going to, when it was sent, in what order with respect to the previous ones. That envelope is also encrypted, of course. But until now, in previous versions of Solo2, the envelope key tended to stay the same for a long time. What could be deduced if someone got it? The content would remain illegible, yes, but a profile could be drawn: how many times you talk to someone, at what time, with what cadence, in what order.
With the new design that we launched in Solo2, the envelope keys are also renewed periodically. What we already take care of for the content we extend to the shipping data. Real privacy, also of the metadata.
A clarification on that word is in order. Solo2 metadata is the sending data that travels within the encrypted tunnel between the sending and receiving device — nothing more. There are the logs that some services keep on their servers about who you talk to, when and from where. Those, in Solo2, do not exist: there is no server to go through.
in a sentence
Solo2 protects you in two layers. First, where your messages don't go; then by how the few bytes that do leave the device travel. For most people, the first coat is enough. For those who send something that matters especially – sensitive documents, conversations with a patient, open cases, proposals with confidentiality clauses – the second exists and works silently.
Solo2 is made not to be noticed. We think about it with love and maintain it with discipline.