Trust & encryption.
Trust starts with cryptography you can name and limits we refuse to hide. Here is how Blink seals messages, where keys live, what servers store, and what is still on the roadmap.
Trust model
Four pillars of how we earn trust
Cryptography you can name
AES-256-GCM authenticated encryption seals messages and media on device. Keys are agreed with ECDH on P-256 and derived with HKDF-SHA256.
Forward secrecy by epoch
Deterministic dm_v3 and group_v3 protocols rotate to a fresh key epoch every seven days, so a compromised key does not reopen an unbounded past.
Ciphertext-only servers
ScyllaDB stores scrambled ciphertext. Media is client-side encrypted before object storage. Our infrastructure never holds keys that can read your content.
Honest limits
We publish what is live and what is next. Trust is built by refusing to overclaim calls, residency, or features that are still shipping.
Cryptography
The stack at a glance
Exact building blocks security teams ask for in a briefing.
- Message & media seal
- AES-256-GCM authenticated encryption on device
- Key agreement
- ECDH on the NIST P-256 curve
- Key derivation
- HKDF-SHA256
- Protocols
- Deterministic dm_v3 (direct) and group_v3 (groups)
- Forward secrecy
- Seven-day key epochs
- Server storage
- Ciphertext only in ScyllaDB; encrypted media objects
- Call posture today
- Secure media-server mediated (full E2EE calls on roadmap)
- Regions today
- United States and India (Swiss/GDPR residency planned)
Practices
How trust shows up day to day
No readable content on our side
If a server cannot decrypt, it cannot casually leak plaintext. That is the baseline for every trust conversation with security and legal teams.
Device-held keys
Your devices hold derived keys and an encrypted vault. Cloud convenience does not require giving Blink a master key.
Published status and change log
Incidents, component health, and versioned engineering notes stay visible so trust is continuous — not a one-time marketing claim.
Verify it with your team
Bring security and legal to a live walkthrough — or follow the public status page and change log for continuous signal.