Security

Security at Sika

Privacy is the product. This page explains how it is protected and how to help us keep it that way.

How Sika protects you

• End-to-end encryption. Messages, files and call audio are encrypted on your phone and decrypted only on the recipient's phone. Direct connections use the Noise protocol. Mail that waits on a relay is sealed to the recipient.
• Keys stay with you. Your identity is an Ed25519 key pair created on your phone. The private key never reaches a server. Messaging keys and any payment keys are separate.
• Encrypted storage. Chats, contacts and files are stored in an encrypted database on your phone. An optional PIN locks the app.
• Verified contacts. Compare a safety number with a contact to confirm that nobody sits between you.
• Signed releases. Every Android release is signed with a single release key and published with a SHA-256 fingerprint. The app checks the fingerprint before it installs an update.
• Servers that carry, not read. Today our servers carry sealed mail, wake your phone, introduce a group invitation to the person who holds it, and relay calls. They hold no keys and see no content of private chats, files or calls.
• We tell you first. If you add a phone number or email, our servers keep a scrambled form of it and the Sika key it belongs to, so friends can find you. They still see no message, file or call. Some features we plan, such as finding friends from your phone book, public channels and cloud backup, need our servers to know more, for example who is on Sika or what is posted publicly. Private chats stay end-to-end encrypted, public content is kept clearly apart from them, and we update this page and the Privacy Policy before such a feature reaches you.
• Backups only you can open. A backup is a file locked with a code you hold. We never receive the code.

Report a vulnerability

We welcome reports from security researchers. If you believe you have found a vulnerability in the Sika app, relay, push gateway, order service or this website, email security@sikaos.app.

Please include what you found, the steps to reproduce it, and the impact you believe it has. Encrypt sensitive details if you can, and ask us for a key.

What to expect from us

• We acknowledge your report within three business days.
• We keep you informed while we investigate and fix the issue.
• We credit you in our release notes if you wish, once the fix is available.
• We will not take legal action against research carried out in good faith under this policy.

What we ask of you

• Test only with accounts you own, and do not access, change or delete other people's data.
• Do not run denial-of-service tests, spam, or social engineering against our team or users.
• Give us reasonable time to fix the issue before you disclose it publicly.

In scope

The Sika Android app and the Windows and Linux test builds, the relay, the push gateway, the order service, the update and feedback services, and this website. Reports about third-party services should go to their operators.