Europe's most secure
messenger.

Three things together: encryption is the standard in every chat, not just in a special mode. Operations and company domicile are entirely within the EU, so European law applies and no third-country access rights do. And for the encryption we rely on open source libraries that can be verified independently. Competitors meet these individually. In this combination, to our knowledge, nobody does.

Your message is encrypted on your device and only decrypted again on the recipient's device. In between it sits on our servers as an unreadable block of data. For the key exchange we use X3DH, modelled on the Signal protocol. Forward secrecy via the Double Ratchet is in preparation and not yet active.

In Nuremberg, with a European provider. There is no data processing in the US and no US provider in the stack. heloo therefore falls outside access rights that expose European user data in third countries.

That depends on size, mode of operation and requirements. A school with its own instance involves different effort than a state administration running it in its own data centre. So there are no list prices, but a quote after a short conversation.

We answer every lawful request, but we can only hand over what we hold. Message content is not part of that, because on our servers it exists only as an unreadable block of data. What we do hold is minimal technical data such as the time of the last connection. Every request received is published in anonymised form in our transparency report.

Not yet: the client source code has not been published so far, that is planned for the open beta. Open source alone is not enough anyway, because nobody can see what a provider actually compiled. That is why we additionally plan reproducible builds: anyone compiling the source themselves should end up with exactly the same file as the one in the store.

What can arise: connection timestamps, approximate message sizes and technical error logs. What does not arise: who writes to whom, how often and about what. Operational data is deleted after 30 days, error logs after 7. The full list is in the privacy notice, not just a summary.

Every chat has a safety number that must be identical on both devices. You compare it once in person or by QR code. If it later changes unexpectedly, heloo warns you actively, because that is precisely the sign of an attack on the connection.

For enterprise contracts: the source code of the server components is held in escrow, and in the event of insolvency or discontinuation you receive the right to keep running it yourself. If you operate in your own data centre, the instance keeps running independently of us anyway. This is in the contract, not in a letter of intent.