Key takeaways
- Layer 1: TLS encrypts every message and file in transit.
- Layer 2: AES-256 encrypts stored content at rest, with a separate key per organization.
- Access rules sit on top: group audit for owners and admins, private direct messages.
- C Chat uses auditable encryption, not end-to-end encryption.
- Platform access to content is limited to moderation of reports and legal requirements, and logged.
Security pages often say “your data is encrypted” and stop there. That sentence alone does not tell you much. Encrypted where? With whose key? Who can decrypt? This page follows a message through C Chat, layer by layer, so you can answer those questions yourself.
Short answer: two layers of encryption, then access rules
How C Chat encryption works fits in three lines:
- In transit: TLS between your device and C Chat.
- At rest: AES-256, with a key that belongs to your organization.
- Access: rules that decide who can open each conversation.
The combination is what C Chat calls auditable encryption. The organization keeps oversight of its group records; people keep private direct messages. If you want to compare it with the alternative, read auditable vs end-to-end encryption.
The journey of a message
- You send a message in a group or a direct message. It might be text, a photo, a voice note or a file.
- It travels over TLS to C Chat’s servers. Anyone sitting on the network, such as a public Wi-Fi operator, sees encrypted traffic, not your message. More on this in TLS in transit.
- It is stored encrypted with AES-256 using your organization’s key. A copy of the stored data on its own does not reveal the content. See AES-256 encryption at rest.
- An authorized person opens the conversation. The service checks the access rules, decrypts the content and sends it to that person’s device, again over TLS.
Attachments follow the same path. The page on how photos, files and voice notes are protected covers their specifics, such as the 25 MB limit.
The two encryption layers explained
TLS: protection on the move
TLS is the same family of protocol that protects online banking and shopping. It encrypts the connection and lets your device verify it is talking to the real server. The glossary explains encryption in transit in more depth.
AES-256 with per-organization keys: protection in storage
AES-256 is a symmetric cipher: the same key encrypts and decrypts. Using a separate key per organization means each customer’s data is encrypted under its own key rather than one shared key for everyone. The dedicated page on per-organization encryption keys explains why that design choice matters, and the glossary entry on key management covers the general discipline.
Who can see what
| Who | What they can open |
|---|---|
| Group members | Their groups |
| Direct message participants | Their own direct messages |
| Team owners and admins | All group conversations of the team, with audit and export |
| Security companies on CGuard Pro | Site groups and security-related chats with guards and office |
| C Chat platform | Content only for reported-message moderation or legal requirements, logged |
What it means for owners, admins and members
Owners and admins get records without needing to collect phones. If a client disputes what was agreed in a group, you can audit and export that conversation.
Members can rely on the network and storage being encrypted, and on direct messages staying out of team audits.
IT reviewers filling in a vendor assessment can use the summary above directly. The guide to security questions to ask a messaging vendor lists the follow-up questions worth asking of any provider, including this one.
Honest limits and caveats
- Not end-to-end. Because the service can decrypt stored content under its access rules, C Chat is not end-to-end encrypted. Platform access is limited and logged, but it is possible.
- Devices matter. Encryption protects data in transit and in storage. It does not protect an unlocked phone left on a desk, or a screenshot.
- Encryption is not access control. Who sees what depends on group membership. Keep groups tidy and remove people who leave.
Getting started
The quickest way to understand the model is to use it. Create a team at getcchat.com/c, set up one group for a real workflow, and invite two colleagues. Then read the security overview for the complete set of protections.
Frequently asked questions
What encryption does C Chat use?
TLS for data in transit and AES-256 for data at rest, with encryption keys specific to each organization. The model is called auditable encryption because the organization can audit and export its group conversations.
Is AES-256 secure?
AES-256 is a widely used, standardized symmetric cipher and is considered strong when implemented and managed properly. The more important practical questions are who holds the keys and who is allowed to decrypt.
Can C Chat employees read my messages?
The platform only accesses content to moderate a reported message or to meet a legal requirement, and every such access is logged. Outside those cases, staff do not access message content.
Are voice notes and photos encrypted too?
Yes. Attachments, including photos, videos, files and voice notes, travel over TLS and are stored with AES-256 at rest like text messages.
Why doesn't C Chat use end-to-end encryption?
Because businesses using C Chat need to audit and export their group conversations for records, disputes and oversight. End-to-end encryption would prevent that. C Chat explains the trade-off openly instead of hiding it.