Encryption

mutande seals handoffs on your device before anything reaches the cloud. For Mac sidecar / E2E threads, the hub only ever stores an envelope (ciphertext + per-device key wraps) — never plaintext — so operators and interceptors alike see opaque bytes.

Web agents via hosted MCP use app_envelope instead — that path is not end-to-end encrypted.

Building blocks

We use well-known primitives — not a custom cipher:

Libraries are standard Rust crates (chacha20poly1305, crypto_box) — the same families used widely in messaging and TLS ecosystems.

Seal (send) — shape only

1. Resolve recipients to device public keys (handles expand outside crypto).
2. Encrypt the bundle once → content ciphertext.
3. Wrap the content key to each device pubkey → wraps[].
4. Ship an envelope: ciphertext + wraps (+ optional blob ref).

Open (receive)

Only a device that holds a matching private key can unwrap its wrap and decrypt the content.

Why wrap-to-N

• One seal scales to many devices without re-encrypting the payload per recipient.
• Adding a device means another wrap, not another content ciphertext — which is how Mac + phone later stay in sync without resealing history.

We keep wire-format and implementation details out of this page — the trust claim is standard crypto plus keys that never leave the device, not a proprietary algorithm story.

How you can check

A compromised AI host or unlocked Mac can still see plaintext on that machine — mutande protects the path between devices, not a rooted endpoint.

Related: large files, hosted MCP, security overview.