We can't read your messages.

The invariant

One rule governs the whole system, and everything else follows from it.

The services we do operate broker identity, notification, discovery, and provisioning. They exchange metadata about workspaces — never their contents. This isn't a configuration you could accidentally turn off; a message has no route to us to travel down.

Central never connects to your server

Every conversation between your box and ours is one your box started.

We hold no inbound path to your machine — no callback address, no persistent tunnel, no polling agent with credentials to your host. When your server needs something from us, it reaches out, does the exchange, and hangs up. Nothing in our code can initiate a connection to a customer's daemon, which means a compromise of our infrastructure does not become a route into yours.

How enrollment establishes trust

The entire relationship rests on one handshake, and we only ever hold half of it.

1. Your server makes a key

   It generates an elliptic-curve keypair locally. The private half never leaves the machine, and we have no mechanism to request it.

2. You courier the public half

   Your server prints an enrollment code carrying its public key and an opaque workspace identifier. You paste it into the console. A human moves it — nothing automated reaches across.

3. It proves possession

   Your server signs a single-use challenge with the private key. We verify against the public one. The binding activates, and it can be revoked from your console at any time.

The identifier we hold is deliberately opaque — it names a workspace without describing it. And because trust rests on a key your machine controls, revoking a compromised server is something you do, not something you file a ticket about.

Push notifications carry no content

Mobile push is the one place a naive design would leak everything — most vendors hand the message text to Apple and Google to display on your lock screen. We don't, because we never have it.

Your server decides that someone should be woken and sends us a notification request stripped to metadata: which device, which channel, what badge count. Our gateway rejects any field that could carry message text. We don't store device registrations either — your server owns that list and passes what's needed per notification. The relay is stateless and forgets you the moment it's done.

Exactly what we store

Vague reassurance is worth nothing. Here is the actual list.

Card details are not on that list either. Payment fields are handled by Stripe's own elements and tokenized in your browser — the number never reaches our servers, our logs, or our database.

No AI, anywhere in the stack

There is no assistant summarizing your channels, no model indexing your history, and no vendor with a license to train on it. This isn't a setting we let you switch off, and it isn't a promise we could quietly revise in a policy update. Your messages never reach us, so there is nothing on our side to feed a model with.

Air-gap it if you want to

Run stand-alone and OpenChime depends on nothing we operate. No license check, no telemetry callback, no phoning home. It will run on a network with no route to the internet at all. You lose the federated conveniences — mobile push most visibly — and you gain a chat system that cannot leak to us because it cannot reach us.

Verify all of this yourself

OpenChime is open source. The wire protocol, the storage schema, the authentication design, and the trust model are documented and the code implementing them is public. Everything on this page is a claim you can check rather than one you have to accept.

Read the source