Chats Security

Open & Closed Chats/Channels

Your organization's server administrator can open a chat or channel for all server users: the chat then appears in the corporate chat catalog. They create a new open chat in the Open Chats section and make a closed chat open in the Chats section.

Chat/Channel Type	Description
Closed Chats and Channels	Private chats and channels. Corporate chats and channels are created as closed by default. Personal chats are always closed. Closed group chats and channels are for a limited audience and are therefore not available in the corporate chat catalog. New users are added to a closed group chat or channel by the chat administrator manually or via an invitation link. The corporate server administrator can make a public chat or channel closed in the admin panel. For Administrators: How to Make a Chat or Channel Closed on the Server To close an open chat, in the admin panel open the Open Chats section and click the trash can button next to the chat you want. Another way: in the Chats section, find the chat and, on its page, click the Remove from Open Chats button.
Open Chats and Channels	Public chats and channels. Any user registered on this server can join them through the corporate chat catalog. Call or conference chats are always open. Only a corporate server administrator can create a chat or channel as open immediately or make a closed one open. For Administrators: How to Make a Chat or Channel Open on the Server In the corporate server admin panel: To create an open chat or channel, open the Open Chats section and click the Create button. The first member of an open chat cannot be added in the admin panel. The first member must join via the client app through the catalog. To convert a closed chat or channel to open, find the chat in the Chats section and click the Convert to Open Chat button. When a closed chat or channel becomes open, end-to-end encryption is automatically disabled in it. Later it can be re-enabled with consideration of member limitations. For Administrators: Opening Chats on Multiple Servers Chats are loaded onto the servers of each participant in the conversation. Therefore, to make a chat open on multiple servers, ensure that the chat has at least one user from the desired server. If there isn't one, add at least one such user to the chat and make that user an administrator. Then the Convert to Open Chat button appears.

Chats Encryption

All chats are stored on the server in encrypted form. On the client device, chats are also stored in encrypted storage. All information in the messenger is transmitted over the TLS protocol. At the customer's request, Russian cryptographic algorithms are supported.

Can Anyone Else See My Correspondence Besides Me?

No external party can read the content of your correspondence, even the server administrator.

End-to-End Encryption

Restrictions and capabilities of chats and channels depend on whether end-to-end encryption is enabled.

E2E	Description
Off	In such chats (shared chats), you can add more than 128 participants. History is available to new members from the moment encryption was disabled. The correspondence is encrypted with a common server key instead of individual keys of each participant. The shared key allows you to add more participants and open the history to them. Protection is lower in this case: if an attacker gains access to the server, they can steal the shared key and decrypt the correspondence. Chats with end-to-end encryption disabled are marked with an unlocked padlock icon on the avatar.
On	In such chats, you can add no more than 128 participants. The conversation is encrypted with each participant's individual keys. New members don’t see the old conversation: it isn’t encrypted with their keys. Old messages are not re-encrypted for new participants.

Who Has Access to End-to-End Encryption and Where Does It Work?

End-to-end encryption is available to both corporate and public users.

Chats for group calls and conferences (rooms) have end-to-end encryption permanently disabled. The administrator of the corporate server can customize the creation of chats and channels with end-to-end encryption disabled. You can enable it later.

In personal chats, end-to-end encryption is always enabled and cannot be disabled.

Will New Participants See Previous Messages If I Turn Off End-to-End Encryption?

⚠️ No. New members will see history only from the moment end-to-end encryption is disabled. Earlier messages are not re-encrypted: they remain encrypted with the participants' previous keys. For new participants to see the entire history, the chat creator or administrator must disable end-to-end encryption when creating the chat and add at least one participant from each corporate server.

Can the Server Administrator Disable End-to-End Encryption?

Yes, but only for chats. End-to-end encryption in channels can only be disabled through the app; the corporate server administrator does not have this capability.

Why is the Number of Members Limited to 128 for E2E?

The limit of 128 participants is due to technical limitations

Who Can Manage the E2E Encryption?

The chat creator or administrator can manage end-to-end encryption. The corporate server administrator — only in chats.

Routing — How Traffic Flows in a Chat

Routing (routing scheme) shows which servers traffic goes through in a specific chat. The scheme is available in a chat of any type. To view the routing scheme, open the chat properties and select Routing.

The diagram is built relative to the member who opened it. The lines on the diagram are paths from their server to the servers of other chat participants. Trusted corporate servers are connected by lines to each other.

Can Messages Be Sent Between CTS Servers Directly, Bypassing RTS?

Yes, if the chat is on one server or between trusted servers. Then traffic bypasses the public regional transport server (). If the chat is created between non-trusted servers or includes at least one user from an external server, traffic will go through .

Phishing Protection

When someone who is not in your address book writes to you in a new personal chat, the app shows a warning about the risk of phishing and malicious attachments. You must confirm the warning to continue the chat.

The administrator of your organization's server chooses for contacts from which servers the warning is shown: admin panel > Security. By default, the warning is shown for users of the public server and of corporate servers without a trusted connection to yours.

Confidential Mode

Confidential mode allows you to configure the deletion of messages by a timer after they are read or sent, both on clients and the server. This is the only way to delete messages on the server. In this mode, screenshot protection is enabled: a warning about an attempt to take a screenshot appears in the mobile app. File downloading is blocked: they can only be viewed in chat, and not all formats are supported. Additionally, you can restrict access to messages to mobile devices only.

How to Enable the Confidential Mode?

Open the required corporate chat card and select the Confidential Mode settings item.

When is the Confidential Mode Unavailable?

• Cannot be enabled in channels — the Confidential Mode is only available in group and personal chats.
• It can be enabled and configured by any corporate participant if there is no participant from a public server or guests in the chat.
• If a chat has more than 256 participants, confidential mode cannot be enabled.
• The web app doesn't support the Confidential mode due to technical limits (since version 3.44).
• In the desktop app, you cannot manage the mobile access setting.
• In certain corporate builds of
  ETS
  web and desktop apps, privacy mode may be unavailable. Check with your organization's support team.

How to View Blurred Messages After Exiting Confidential Mode?

To view messages sent in confidential mode, click on any message with blurred content: the mode will turn on.

How to Forward Messages From Confidential Mode to Another Chat?

By default, forwarding from confidential mode is disabled in the corporate server settings. If your organization's server administrator enables Allow users to configure message forwarding in confidential mode in the “Server” section, forwarding will appear in confidential mode settings.

For Administrators: DLPS and Confidential Mode

In the general settings of the DLPS administrator panel, you can enable sending messages from confidential mode to the corporate data leak prevention system.

---

Role Model and Corporate Data Transmission Network (CDTN) Contour Configuration

Using the role model and contour settings of the Corporate Data Transmission Network (CDTN), a company administrator can restrict access to information in chats. For example, prohibit screenshots and application screen recording or forwarding files from confidential chats.

Support for Data Leak Prevention Systems (DLPS)

If your organization has a data leak protection policy, clock icons may appear on messages. Yellow — message is being verified for leaks. Red — the message failed the check and cannot be sent. For details, contact your organization's support.