Veep Open Veep
Security

Straight answers about your privacy.

Not everything in Veep is end-to-end encrypted, and we would rather say so clearly. Here is exactly what is protected, how, and what we are still working on.

At a glance

What is protected, and how

“Encrypted in transit” means the connection between your device and our servers is encrypted (HTTPS / TLS), so others on the network cannot read it. “End-to-end” means only the people in the conversation can read it, not even Veep.

Encryption in Veep, by type of content
WhatProtectionWho can read it
Secret chats (one-to-one text)End-to-end encryptedOnly the two phones in the chat. Keys are made and kept on each phone; our server stores and relays ciphertext it cannot read.
Audio and video callsEncrypted between devicesThe people on the call. Media is encrypted with DTLS-SRTP; a TURN relay, when used, only passes encrypted packets.
Regular one-to-one chatsEncrypted in transitYou, the people in the chat, and our server, which stores messages for up to 30 days so a new phone can catch up.
Group chatsEncrypted in transitGroup members and our server. End-to-end encryption for groups is on our roadmap.
Photos, videos, files and voice messagesEncrypted in transitThe people in the chat and our server, for up to 30 days. Not end-to-end encrypted yet, even inside a secret chat.
StoriesEncrypted in transitThe people you allow to see them, and our server until the story is deleted after 24 hours.
BackupsLocked with your passwordOnly someone with the password you chose. The backup file is encrypted before it leaves the app.
Secret chats

End-to-end encryption for one-to-one text

Start a secret chat from a chat’s ⋯ menu. Each phone creates its own keys and never shares the private part. Messages are encrypted with well-studied, standard building blocks:

  • P-256 ECDH to agree on a shared secret between the two phones.
  • HKDF-SHA-256 to turn that secret into encryption keys.
  • AES-256-GCM to encrypt every message, with both people’s public keys bound to it.

Check you are talking to the right person

Open ⋯ → Verify security code and compare the 60-digit code with your friend, in person or on a call. If someone’s code changes, Veep warns you.

48213 90577 12046 66310 · 73508 21944 05862 31179 · …

Secret chats cover text messages between two people. Photos, files and group chats are not end-to-end encrypted yet.

Calls

Calls are always encrypted

Audio and video calls use WebRTC, which encrypts the media between devices with DTLS-SRTP. When a direct connection is not possible, a relay (TURN) forwards the call, but it only ever sees encrypted packets.

Four emoji, same on both screens

During a call, both people see the same four emoji at the top. If they match, nobody is sitting in the middle of your call.

🦊 🌵 🎈 🍋

Restricted networks

Where internet calls are blocked, Veep can send calls only through the relay over TLS on port 443, so they look like ordinary secure web traffic. It turns on automatically in some regions, or you can switch it on in Settings → Data and language.

Your account and device

Protection around the edges

App lock

Lock Veep with a PIN, fingerprint or face, so someone holding your unlocked phone still cannot open your chats.

Careful sign-in

Passwords are stored as bcrypt hashes, never as plain text. Repeated wrong passwords and rapid sign-up attempts are limited to slow down guessing.

Encrypted backups

Export your chat history to a file locked with a password only you know, and restore it on any phone.

Privacy controls

Choose who sees your last seen, profile photo and stories, and turn read receipts off. Block and report anyone.

30-day server window

Our server deletes messages and their files after 30 days. Your phones keep the history; My Notes are kept so you don’t lose them.

A hardened web app

A strict Content-Security-Policy with no outside scripts, no framing, and security headers on every server response.

Still to do

What we are working on

  • End-to-end encryption for photos, files and group chats, with keys for more than one device.
  • Ongoing hardening of the server and apps before a wider launch.

Found a security problem? Please tell us privately at support@veepchat.com. Read our privacy policy for what data we keep and why.