Hardware keys
On first launch, ORBLINK generates a P-256 signing key inside the phone's secure hardware: the Secure Enclave on iPhone, StrongBox or the trusted execution environment on Android. The app reports which tier your phone provides. The private key can't be exported, not to our servers, not into a backup, not to us on request. Every signature needs a fresh biometric or passcode check. From the public key the app derives a stable identifier.
Message encryption
Every conversation is its own cryptographic group under the Messaging Layer Security standard, RFC 9420, which gives forward secrecy and clean key rotation. Messages are sealed on the sending phone and opened only on the receiving one.
How sealed messages travel
Calls connect phone to phone. Messages travel as sealed envelopes: when the other phone is offline, a mailbox holds the envelope until it can be delivered, and it can't open it. It stores a sequence number, sealed bytes and an expiry time. There's no sender field in the protocol, and the relay holds no key. It sees what any network sees, which IP address connected, when, and how much moved, and never the content.
Attachments
Photos, files and voice notes are encrypted on the phone with a fresh key per send, then stored by a hash of the sealed bytes. Storage learns nothing about the content, not even whether two people sent the same file. Attachments are limited to about 25 MB.
Pairing and safety numbers
You connect by invitation link or QR code. The invitation's secret travels in the part of a link that browsers never send to a server. The two phones then run a pairing ceremony and show a safety number you can compare out loud.
Calls
Voice and video calls, one to one or in a group, are encrypted end to end. One-to-one calls run directly between phones where the network allows. Both phones compute the same short safety code from both keys, so a cloned voice on another device can't pass as someone you know.
Recovery
ORBLINK offers a recovery phrase, a passphrase-sealed backup, and the option to split the secret into shares so no single holder can use it. There's no custodial fallback and no master key.
What's in the app
No analytics, crash-reporting or attribution SDK is in the build: no Firebase Analytics, Crashlytics, Sentry, Amplitude, Mixpanel, Segment, PostHog, AppsFlyer, Adjust or Meta SDK. Fonts ship inside the app, so it never calls a font service.
Report a vulnerability
Write to support@orbis.id with "Security" in the subject. Please tell us before anyone else, and we'll work on it with you and credit you if you'd like.