04 — Research
VeilX — the messenger we built for ourselves.
VeilX is the one thing on this site we did not build to a brief. Our own team's messaging was too important to outsource to something none of us could inspect, so we built it on Matrix, run it on tuwunel, and hardened it for the threat that actually matters on a phone: someone else holding it.
Two postures
One of these is right for you. Not both.
Most secure messengers pick a point on the convenience-versus-exposure line and hide the choice. VeilX puts it in the settings screen, in plain words, with the trade-off stated.
Standard
Everyday workThe local message store is encrypted with a key derived from your PIN. It unlocks offline, any time. This is the level that protects you when a phone is lost, lent out, or picked up by someone curious.
Maximum
Cleared rolesEverything above, plus a server-held lock. An offline device cannot be opened by anyone. When a phone goes missing or someone leaves, an administrator disables it centrally. The cost is real: unlocking needs connectivity.
What is actually in it
Built for the phone being taken, not the network being sniffed.
Transport encryption is table stakes and every messenger has it. Almost none of them have an answer for the moment the device is in someone else’s hand, powered on, with your session already open.
Keys and encryption
- Message store
- Encrypted with a key derived from the PIN through Argon2id
- Hardware backing
- That key is wrapped by StrongBox, a separate secure element. It is non-exportable — a flashed image of the device does not contain it
- Tokens and proxy config
- Encrypted at rest alongside the messages, not left in plaintext preferences
- In memory
- Keys are evicted the instant the screen goes off. That behavior is unconditional and not exposed as a setting
Access control
- PIN app lock
- Opening the app requires a PIN, independently of the device lock screen
- Duress PIN
- A second PIN that permanently erases local data instead of unlocking. It looks like a normal unlock attempt
- Emergency notification
- Optionally, entering the duress PIN also alerts a chosen contact with a location. Off by default
- Remote lock and wipe
- An administrator can lock or erase a handset from the server. Commands are server-signed, so they cannot be forged — and the switch cannot be turned off from the phone, because a kill switch the holder can disable is not one
Automatic locking
- USB or ADB data
- A locked phone should only ever be charging. A data connection appearing is usually a tool trying to read the device
- SIM or eSIM removal
- Pulling the card generally means the device has left your control — and is a common way to pre-empt a remote wipe
- Airplane mode
- Same reasoning, one tap earlier. Off by default, since flights and battery saving trigger it too
- Geofence
- Named coordinates that lock the app on arrival — a client site, a venue, anywhere the phone should be inert before it is out of your hands
On screen
- Screenshot and thumbnail blocking
- Suppresses screenshots and the task-switcher preview, which leaks content without anyone opening the app
- Notification privacy
- The lock screen shows neither sender nor message body
- Background grace period
- Optionally keeps notifications alive for a few minutes after switching apps. Turning it off is the stricter setting; screen-off eviction happens either way
Protocol
Matrix, so nobody has to trust us.
Message content is encrypted on the sending device and decrypted on the receiving one. Devices are cross-signed, so adding one is a visible, verifiable event rather than a silent one. The homeserver stores ciphertext it cannot read — including when the homeserver is ours.
Because it is an open protocol, you can federate with partners, restrict federation to an allowlist, or switch it off entirely. And you can leave. That last one is the point: an encryption promise you cannot walk away from is not much of a promise.
An honest note
What none of this solves.
End-to-end encryption protects message content in transit and at rest on the server. It does not hide metadata about who talks to whom and when, it does not survive a device compromised below the app, and it does not stop the person you are talking to from taking a photograph of the screen.
The Maximum posture has its own cost, and we would rather state it than have someone discover it at a bad moment: with no network there is no unlock, and the duress PIN does not take effect either, because it is validated server-side first. The data is intact. It is simply not reachable until the device is online.
Any vendor telling you their product has no such edges is selling something.
Self-hosting
Run the server yourself, in one command.
There is no backend of ours to sign up for, so the homeserver is yours to run. On a fresh Ubuntu VPS this installs tuwunel, issues certificates, and brings up a web client and an admin panel — about ten minutes, mostly waiting. You need a server and a domain; the installer explains every option in plain language as it goes.
SSH into your server, then paste this
sudo apt-get update && sudo apt-get install -y wget && wget -O tuwunel.sh https://lockmere.io/veilx/install.sh && sudo bash tuwunel.shPrefer to read it before running it? That page publishes the SHA-256.
VeilX legal
The app's policies, in full.
These two documents govern the VeilX Android app — not this website. Both are published in English and Chinese, and both say the same thing the app does: we run no servers, hold no accounts, and receive nothing.
Privacy Policy
What VeilX stores on your device, what goes to the homeserver you chose, and every third party your device contacts — each one listed with what it can observe.
Read itTerms of Service
The licence, and plain warnings about the features that destroy data on purpose. Worth reading before you turn the emergency PIN on.
Read itNeed something like this inside your own organization?
We built it for our own team, so we know exactly what it cost and where the sharp edges are. Tell us the threat model you are actually working against and we will tell you honestly whether this shape fits it.