Security you can verify, not just trust

Private by architecture, not by policy promise.

Ask a security question

Encrypted end to end

New channels are encrypted by default, not as an add-on you have to remember to switch on.

You hold the messaging keys

Messaging keys live on your devices, never with a provider.

Open protocols

Matrix and JMAP: auditable, portable, no lock-in.

Encryption settings and key backup in Rhaetix.

How end-to-end encryption protects messaging

Encrypted on your device

Chat messages and shared files in encrypted channels, plus call signalling, are encrypted before they leave your laptop or phone.

The server stores ciphertext

For this data, our server or yours only ever sees ciphertext it cannot read.

Only recipients can decrypt

Keys stay on your team’s devices. Not with us, not with any cloud.

What our servers can see

The table we would want from any vendor. Encryption claims mean nothing without the boundaries. Here they are, precisely.

Your data What the server holds Can it be read server-side?

Chat messages & shared files In an encrypted channel, ciphertext only, encrypted on your device before it is sent (Matrix Olm/Megolm). New channels are encrypted by default; one deliberately created without it, and service announcement channels, are held like any plain Matrix room. No · E2EE

Call signalling End-to-end encrypted, like messages. No · E2EE

Your encryption keys Never in readable form. Your devices hold the keys. The optional key backup IS stored on the server, encrypted under a recovery key that exists only with you. The server therefore holds ciphertext it cannot open, and losing that recovery key loses the backup. No · E2EE

Call media (voice & video) Encrypted in transit and relayed by the media server. Self-host it to own the entire path. Relay only

Mail Stored encrypted at rest. Content is processed for delivery and spam filtering. That is how open mail standards work. Yes · encrypted at rest

Documents, sheets & slides Real-time collaboration is merged server-side; content is encrypted at rest and in transit. Yes · encrypted at rest

Drive files & calendar Stored encrypted at rest; access follows workspace membership. Yes · encrypted at rest

Wiki pages A wiki page is a Drive document. Merged server-side so people can write it together, encrypted at rest and in transit. Yes · encrypted at rest

Kanban boards A board is a sheet, so it is held exactly like one and readable on exactly the same terms. Yes · encrypted at rest

Tasks JSCalendar tasks over JMAP, in a Tasks calendar beside your others. Encrypted at rest, same boundary as the calendar. Yes · encrypted at rest

Metadata (who, when, sizes) Visible: required to route and deliver anything at all. Yes · encrypted at rest

Every “yes” above is a fact of how open standards work, not a choice we hide. And it is exactly why Rhaetix is self-hostable: run it yourself, and this whole table lives on your hardware, under your law.

End-to-end encryption by default

Messages and files are encrypted on your device before they are sent. Only the intended recipients hold the keys to decrypt them. The server, ours or yours, stores ciphertext it cannot read.

Key backups are protected by a recovery key that only you know. Losing a device does not mean losing your history; sharing it with your provider is never required.

Open protocols, no lock-in

Messaging and calls are built on Matrix, mail and calendar on JMAP: open, documented protocols with active security communities. Your data is portable and your workspace speaks standards, not proprietary formats.

Verifiable, down to the deployment

The strongest security claim is one you can check. Rhaetix can be self-hosted in full: run it on your own hardware, audit the traffic, own every layer.

Explore deployment options

No ads, no data mining

Rhaetix is paid software. Your data is never scanned for advertising, profiling or model training. The business model is the subscription, nothing else.

Security Measures and Compliance Overview

At Rhaetix, security is not a feature, but the foundation on which the entire product is built. This page transparently explains how we protect your data and where the limits of our access lie.

Encryption

End-to-end encryption: Chat messages and shared files are encrypted on your device before they leave it. The keys remain with you. Neither we nor our hosting provider can read this content.
Transmission: All connections are protected with TLS (minimum version 1.2, preferably 1.3).
Storage: Server-side storage media are encrypted at rest.
Transparency instead of promises: Which data our servers can technically view and which they cannot is publicly documented in a table on this page.

Hosting and Data Location

All systems and data are located in Switzerland.
Swiss data protection law (revised FADP / DSG) applies; Switzerland benefits from an adequacy decision of the European Commission.
No transfer of data to third countries without your consent. We list our subprocessors publicly.

Application and Operational Security

Multi-factor authentication (FIDO2) and role-based access control for all administrative access
Access to customer data only in documented support cases under the four-eyes principle
Logging of administrative access
Regular security updates (security-critical patches within 7 days)
Monitoring and alerting across all production systems
Tenant isolation: each customer receives a dedicated Workspace instance

Backups and Availability

Twice-daily encrypted backups with 90-day retention
Defined incident response process with notification of affected customers within 48 hours
Details on availability and response times are governed by our Service Level Agreements (SLA).

Compliance

Swiss Federal Act on Data Protection (revised FADP / DSG) and EU GDPR: Our processes and contractual documents (Data Processing Agreement, technical and organisational measures) are designed for both legal frameworks.
ISO 27001: We are currently preparing our Information Security Management System (ISMS) for certification under ISO/IEC 27001.

Found a Security Vulnerability?

We thank security researchers for responsible reports. Details on reporting channels, process, and safe harbor commitments can be found in our Responsible Disclosure Policy and our security.txt.

Security-related enquiries: contact@rhaetix.com

Last updated: 09.11.2026. This page describes the current state of our security measures and is updated when material changes occur.

Further Security and Legal Documents

Subprocessors Current list of our subprocessors and processing locations in Switzerland.Service Level Agreement (SLA) 99.5 % annual average availability target, support response times, and backup RTO.Responsible Disclosure Policy Reporting channel, rules of engagement, and safe harbor commitments for researchers.security.txt (RFC 9116) Machine-readable security contact and policy metadata at /.well-known/security.txt.

Compare Rhaetix with your current suite

See what changes, what stays familiar and which limitations to review before choosing a migration path.

Google Workspace alternative

Apps, encryption, jurisdiction, deployment and migration, side by side.

Compare Google Workspace

Microsoft 365 alternative

Office, OneDrive, SharePoint and Teams, with clear boundaries and migration guidance.

Compare Microsoft 365

Security questions? Ask our engineers directly.

contact@rhaetix.com