Message privacy on OrganizeOS

Every channel, DM, and group on OrganizeOS uses its own AES-256 key to encrypt message content before it's written to the database. Server breaches and stolen backups return ciphertext, not plaintext. This page explains what that actually means in plain language and where the limits are.

How it works

When you send a message, OrganizeOS encrypts the text on the server before it lands in the database. Every channel, DM, and group has its own randomly-generated AES-256 key. Those keys are held by the platform and used to decrypt messages on your behalf when you read them.

When you (or anyone with access to the conversation) reads a message, the server decrypts it in memory and serves you the plaintext. The UI never sees ciphertext, so search, mentions, notifications, attachments, and everything else keep working transparently.

You'll see a small lock icon + "Encrypted at rest" in the header of every channel, DM, and group. Click it for the explainer dialog.

What OrganizeOS can decrypt

Being clear about this is the point of the page. OrganizeOS holds the master key, so the platform CAN decrypt your messages in the following cases:

• Search: when you search a channel, the server decrypts candidate messages in memory and scans them for matches.
• Anything you read in the app: same mechanism. The decrypt happens server-side, the plaintext goes to your browser.
• Audit and moderation reviews: organization admins can review messages in their own org for legitimate moderation needs. Audit-relevant reviews are logged.
• Subpoenaed records: if OrganizeOS receives a legally valid order, we can be compelled to decrypt and produce records.

If any of those concern you for a specific conversation, OrganizeOS is not the right tool for that conversation. See "When to use a different tool" below.

What encryption-at-rest protects against, and what it does not

Encryption at rest is a real safeguard against specific threats:

• A breach of OrganizeOS's database or stolen backups returns ciphertext only. An attacker with the data alone cannot read it.
• A misconfigured database query or a curious-but-unauthorized OrganizeOS employee browsing tables sees <encrypted> placeholders, not your messages.
• When a message is deleted (manually, or via your org's retention policy), the ciphertext is hard-deleted. There's no soft-deleted copy that survives in some backup.

It does not protect against:

• Anyone with legitimate access to your account. A second person who has your password and your 2FA device sees what you see.
• OrganizeOS staff acting in bad faith. A malicious insider with platform access could decrypt anything. We don't do that, but this design relies on that trust.
• Legal orders. A legally valid subpoena can compel decryption. See the note on subpoenas in "What OrganizeOS can decrypt" above.

These are real limits, not edge cases.

When to use a different tool

If your threat model includes the platform itself, or if you need to be sure that no one outside the conversation could be compelled to decrypt your messages, use Signal or Matrix instead. Those tools are built specifically for end-to-end encryption: the keys live on devices, the server never has them, and even the platform operators cannot read your conversations.

OrganizeOS is not trying to be Signal. We deliberately do not claim end-to-end encryption, and we point you to the right tool when you need it. Examples of conversations that belong on Signal or Matrix:

• Strategy discussions where the legal exposure of the people involved depends on the conversation staying private.
• Sources or whistleblowers who need to talk to organizers without the platform being able to link them.
• Anything where you'd want to be able to say honestly: "OrganizeOS could not decrypt this even if compelled."

For everything else, OrganizeOS's at-rest encryption is the right level of protection.

Pairing with disappearing messages: Encryption at rest works alongside message retention (disappearing messages) to strengthen your subpoena posture. When a channel has a short retention window, old messages are hard-deleted before any legal order could reach them. The ciphertext is gone, and even a legitimately ordered decrypt of historical data returns nothing because there is nothing to decrypt.

Why this matters

OrganizeOS is built for orgs whose communications are subpoena-attractive: labor coalitions, advocacy nonprofits, civic groups. Pretending we provide more security than we do would make us a target for actors who think it's better than it is, and would erode trust the moment the gap is discovered. The honest framing here is the protection: you know exactly what we shield against, you know exactly when to reach for Signal, and you can plan your communications with both tools accordingly.