Conversations between a manager and an employee about expenses can touch salaries, health claims, travel plans, and disputes. That’s why direct messages in Reimbilly are end-to-end encrypted: they are encrypted on your device before they leave it, and only your conversation partner can decrypt them. Not our servers, not our staff, not a subpoenaed database dump. Channel messages are a different thing and this post says so plainly further down.
The building blocks
We use NaCl “box” encryption (the libsodium/TweetNaCl construction built on Curve25519, XSalsa20, and Poly1305). Every user gets a keypair generated on their own device. The private key never leaves the device — it’s stored in the platform secure enclave (Keychain on iOS, Keystore on Android). Only the public key is uploaded, so others can encrypt messages to you.
Sending a message
- Your app fetches the recipient’s public key.
- It generates a fresh random nonce for this one message.
- NaCl box encrypts the message with your private key + their public key + the nonce.
- The ciphertext and nonce are stored on the server; the plaintext never leaves your phone.
- The recipient’s device reverses the process with their private key and your public key.
What our database stores per direct message: sender id, conversation id, timestamp, a base64 ciphertext blob, and a nonce. What it can reveal about the content: nothing.
Honest limitations
E2E encryption protects message content, not metadata — we necessarily know who talked to whom and when, or the app couldn’t deliver messages.
Channels are not end-to-end encrypted. They are encrypted in transit and at rest, but your workspace admins can read them, and so could we if compelled by law. That is deliberate: a shared work channel is a business record, and companies need to be able to search, retain and hand over their own records. If a conversation should not be readable by your admin, use a direct message — that is exactly what the encrypted half is for.
Losing every device used to mean losing your encrypted history for good, and this post said so. Since September 2026 you can opt into a recovery phrase: we store your key locked with a passphrase we never see, so you can unlock it on a new device. We still cannot read it, and we cannot reset it — lose the phrase and the history is gone, exactly as before. There is still no support backdoor.