Security and encryption
Encryption is only part of the protection. Nevod's foundation is the Zero Knowledge Infrastructure architecture, in which the developer has no access to users' keys or data.
How your messages are protected
Nevod uses end-to-end encryption: a message is encrypted on your device and decrypted only on the recipient's device. The node that carries the message sees only encrypted data and the service information needed for delivery — never the content.
| What | How it's done |
|---|---|
| Message encryption | CryptoKit — Apple's system cryptography library: X25519 key exchange, SHA-256, ChaCha20-Poly1305 cipher |
| Signatures | CryptoKit: Ed25519 |
| Proving identity when connecting to a node | A zero-knowledge Schnorr protocol built on CryptoKit (Curve25519, SHA-256/512) plus one modular arithmetic operation implemented in Nevod itself |
For every message the sender creates a new one-time key. The recipient's key is long-term: if it were stolen from the recipient's device, previously intercepted messages to that recipient could be decrypted too. That's why protecting the device itself matters — a passcode and an up-to-date iOS.
The Schnorr protocol lets you prove to a node that you own your key without sending or revealing the key itself.
Your node, your rules
The developer sees nothing. A node processes only what delivery can't work without: participant identifiers, chosen names, notification tokens, and which encrypted packet goes to whom. A node never sees the content of messages, photos, voice messages or calls.
Nothing stops you from creating your own node — for yourself, your family, an organization or a community. Then even the delivery data stays with you. How to run your own node →
Export control and the App Store
When publishing to the App Store, a developer declares whether the app uses encryption subject to export control (US EAR, Category 5, Part 2). Nevod declares that it does not, and here's why:
- Everything that hides message content is Apple's system cryptography (CryptoKit). Apps that use only the encryption built into Apple's operating system qualify for an exemption and need no export documentation.
- Nevod's own implementation — one arithmetic operation in the Schnorr protocol — is used only to prove identity. Export control covers cryptography for confidentiality. Cryptography used only for authentication, signatures and integrity is excluded from it.
So Nevod needs no export documentation, including for distribution in France.
This is our reading of the applicable rules, not a legal opinion.