Warrant Canary

Last updated 22/08/2026 · Next update due 22/09/2026

As of 22/08/2026, the operators of Qendra:

have not received any National Security Letters, FISA warrants, gag orders, subpoenas, or other secret legal process;
have not been compelled to insert backdoors, weaken cryptography, downgrade the post-quantum ML-KEM-768 + X25519 hybrid encryption or the ML-DSA-65 + Ed25519 hybrid signatures, or hand over identifying information about any user;
have not been required to log additional metadata, IP addresses, device identifiers, or session data beyond what is described in the privacy notice;
have not handed over private keys, recovery phrases, plaintext, or message contents to any third party;
have not disabled, weakened, or silently bypassed safety-number verification, disappearing messages, signed key-change alerts, the 14-day server-side auto-purge, or the on-device lockdown wipe.

If this page stops being updated past the “next update due” date, or if this statement disappears or is materially weakened, assume the warrant canary has been pulled and treat the service as potentially compromised. Re-verify safety codes with every contact before sending sensitive messages.

Technical guarantees

End-to-end hybrid encryption with ML-KEM-768 (post-quantum) + X25519 (classical).
Hybrid post-quantum signatures with ML-DSA-65 (Dilithium) + Ed25519 — envelopes are only accepted when both verify.
HKDF-based key derivation with per-purpose context labels and a per-message subkey from a monotonic counter.
Sealed sender: the relay sees the recipient only, never who sent a message.
Length-hiding padding to fixed buckets and server-side timestamp bucketing so wire size and timing do not leak content.
Replay-window protection on the client; Realtime presence and broadcast channels disabled to avoid metadata leaks.
Messages are auto-deleted from the relay immediately after the recipient pulls them, and hard-purged after 14 days regardless of delivery state.
Optional per-conversation disappearing messages (15s up to 24h) with sender-signed expiry.
Signed KEY_CHANGED alerts when a contact's keys rotate; sending is blocked until re-verification.
Private keys never leave your device. The local store is encrypted with audited Argon2id (≥ 64 MiB, t ≥ 3) + ChaCha20-Poly1305.
One-tap lockdown wipes all local keys, the message cache, and the outbox.

The cryptography protects message content even if this canary is silently pulled. The canary protects against legal compulsion to change the service in ways the cryptography alone cannot.

Jurisdiction & data residency

Designed and built in the European Union. Application servers, the relay, and the encrypted account database are hosted in EU data centers and governed by EU law (GDPR, ePrivacy, member-state rules).
Edge layer: we currently use Cloudflare in front of the relay for DDoS protection and availability. Cloudflare is a US-headquartered company and is therefore in scope of the US CLOUD Act for the edge layer. Cloudflare only ever sees TLS-terminated, end-to-end encrypted ciphertext — never plaintext, private keys, or message content.
Roadmap: we are actively evaluating European edge providers (Gcore, Myra, others tracked via European Alternatives) with the goal of becoming fully Europe Only. See Privacy for details and sub-processor disclosure.
No data-transfer or sub-processing agreements that would move identifying user data outside the EU beyond the Cloudflare edge described above.