Security, encryption and moderated interactions
Effective 15 October 2026. Version 1.2.
End-to-end encryption is available
FNF has implemented end-to-end encrypted messaging and authenticated encrypted calls. In a conversation marked End-To-End encrypted, supported message text, attachments, voice notes and group content are encrypted on participant devices; FNF routes encrypted content without holding the private message-decryption keys. Device security codes and QR comparison help confirm the intended contact.
Current availability: E2EE access is enabled for approved accounts. It is not yet available to every registered account. Existing ordinary conversations are separate and are not retroactively encrypted. Check the security indicator in the particular conversation rather than assuming that every chat uses the same mode.
| Mode | Protection | Who can access content |
|---|---|---|
| End-to-end encrypted chats | Per-device ratcheted messages and encrypted attachment/voice-note contents; available to approved accounts | Participant devices hold private decryption material. FNF retains routing metadata, not message-decryption keys. A participant may deliberately disclose readable material in a report |
| Authenticated encrypted calls | Encrypted call media with signed negotiation bound to registered device identities | Participating devices. Compare device codes to independently verify identity. Ordinary unmoderated calls are not routinely recorded |
| Other or older ordinary chats | HTTPS transport encryption; this mode is not E2EE | Participants and service systems; staff access depends on granted permissions |
| Calls without authenticated device identities | WebRTC media encryption in transit | Call endpoints; transport protection alone does not verify the intended person's identity |
| Disclosed moderated messages/voice notes | Transport encryption and disclosed server-readable storage | Participants and authorized service/staff systems |
| Consented moderated calls | Encrypted transport plus disclosed endpoint recording and video snapshots | Participants and staff authorized to access captured evidence |
Device identities and recovery
A new device or changed identity may require approval and renewed verification. Compare a contact's code or QR through a trusted channel. An account password reset does not guarantee recovery of encrypted history. Protect device keys and separate archive/recovery material. A compromised endpoint, notification preview or participant's own copy can reveal content outside FNF's encryption.
Screening and consent
A flag indicates screening, not guilt. The screening popup explains the applicable mode. An unflagged participant's lock icon does not make a moderated interaction end-to-end private.
Before a moderated call connects, both participants must personally accept the separate recording notice. It discloses recorded audio and, during moderated video calls, front-camera snapshots at the configured interval. A camera permission or agreement to the main Terms does not replace recording consent. Participants can decline or end the call. Ending stops new capture; previously captured evidence may finish uploading and remain subject to retention and reasoned holds.
Flagging does not reveal earlier encrypted history or silently convert an existing E2EE conversation into a readable one. A moderated interaction uses a separately disclosed mode. When a participant deliberately reports a message with recent context, their device can share readable text from up to ten messages and attachment names with moderators; attachment file contents are not automatically included.
Validation and limitations
Android/browser integration tests have passed for encrypted messages and media, device-code comparison and authenticated calls. This does not constitute an independent audit of the complete FNF integration. Broader group, recovery, device and relay validation remains ongoing. We do not promise absolute security or claim that a library audit certifies the entire service.
Recording can be incomplete because of device or network failures. Call duration alone does not prove complete evidence coverage. Review the Privacy Policy and Terms of Use for data processing, retention and contact information.
SMS sign-in is separate from encryption verification
Where enabled, SMS OTP verifies control of a linked mobile number. It does not automatically verify your contact, approve an encryption device or restore lost private keys. Compare contact security codes and follow device-approval prompts independently of account sign-in.