Security products earn distrust by promising everything. This page says precisely what BlackBoxNG protects, how, and — just as deliberately — what it does not.
BlackBoxNG's group encryption is MLS — Messaging Layer Security, RFC 9420 — the IETF standard for end-to-end encrypted group messaging, built on the OpenMLS implementation. No cryptographic primitive is invented in this product, ever: novel protocols fail audits and deserve to.
What BlackBoxNG owns is the integration: one Rust cryptographic core, exercised by the same test suite natively and in the browser, so there is exactly one codepath for an auditor to review. Documents are encrypted on the device with per-document AES-256-GCM keys distributed inside the MLS channel. Local history is sealed under a key derived from the user's passphrase with Argon2id.
MLS provides the two properties that matter most in a room with changing membership: forward secrecy (past messages stay sealed if a key leaks later) and post-compromise security (the group re-keys away from a removed device — someone taken out of a room cryptographically loses the ability to read anything sent after their removal, a property our test suite proves on every build).
This is not policy — it is construction. The server's audit table has no content column to fill. The blob store holds ciphertext encrypted before it arrived. There is no code path in which plaintext or private keys reach the operator.
BlackBoxNG has no key escrow and no server-side account recovery. A user's history exists only on their devices. If a user loses every device, their history is gone — permanently, for everyone, including us.
This is deliberate. Any recovery path the vendor holds is a confidentiality hole the vendor can be compelled — by court order, by coercion, by breach — to use. The practical mitigation is multi-device: each user runs BlackBoxNG on several devices, and losing one is an inconvenience, not a loss.
A compromised device. End-to-end encryption protects the transport and the server, not the endpoint. Malware on a member's laptop reads what that member reads. MLS limits the blast radius — remove the device and the group re-keys away from it — but until removal, that endpoint sees its rooms.
Traffic analysis. The server operator, or anyone observing the network, can see that communication is happening: who connects, when, how much. BlackBoxNG minimises metadata (no phone numbers, no public discovery) but does not claim to hide traffic patterns.
A malicious server's denial of service. A hostile operator can withhold or delay messages. It cannot forge them, read them, or alter them without detection — but availability always depends on the infrastructure. This is why sovereign customers run their own.
The people in the room. A member can screenshot, photograph, or repeat what they read. No cryptography prevents authorised eyes from leaking; that remains a governance and trust problem, addressed by the audit trail's record of exactly who had access.