What Encrypted Means on a Companion App's Security Page
When a companion app’s security page says your conversations are encrypted, it almost always means two specific and unremarkable things: encrypted while travelling over the network, and encrypted while sitting on the operator’s disks. Neither prevents the operator from reading what you write. The claim that would prevent that is a third, quite different one, and in this category it is almost never true — because the product cannot work if it is.
That is not an accusation. It is the shape of the technology, and once you can see the three claims apart, a security page becomes readable in about a minute.
The three claims, ranked by how much they would mean
In transit. Your messages are protected between your phone and the operator’s servers, so nobody on the café network, the mobile carrier, or any hop in between can read them. This is genuine and important and also universal — every mainstream app has had it for years, browsers flag its absence, and platforms effectively require it. A security page that leads with it is describing table stakes as an achievement.
At rest. Stored data is encrypted on the operator’s storage. This protects against a narrow scenario: someone physically obtaining a disk, or a stolen storage backup. It does very little against the intrusion that actually happens, where an attacker gets into the running application and simply asks it for data the way the app itself does. This is why “the data was encrypted” in an incident notice needs a follow-up question, as set out in when a companion app is breached, what to do first.
End-to-end. Only your device holds the key, so the operator mathematically cannot read the content even if compelled to. This is the claim that would change the privacy picture entirely. It is also the one you will rarely see here, and there is a structural reason for that rather than a conspiratorial one.
The one test: does any feature require the operator to read the content?
An end-to-end claim and a working companion app are close to mutually exclusive, because the reply has to be generated by a system that can read the message. Run down the feature list and ask which of these the app does.
Generating the response. The core loop. Something on a server receives your words as readable text in order to produce an answer. That alone settles it.
Remembering things about you. Retained facts, a profile, a running summary of the relationship. All of it is derived from readable content held server-side.
Content moderation and safety classification. Filters and crisis routing are classifiers running over your text. They cannot classify what they cannot read.
Search across your own history. If the app can find a conversation from months ago by keyword and it does so on the server, the server can read it.
Quality review by people. Where an operator’s policy reserves the right for employees or contractors to read conversations — commonly for abuse investigation or model improvement — that right is only exercisable on readable content.
If the answer to any of these is yes, the conversation is not end-to-end encrypted, whatever the marketing page implies. This is a useful test precisely because you can run it from the outside, on the feature list, without trusting anything the operator says about its own practices.
What a cipher name tells you
Security pages like to name the algorithm and the key length. Treat this as decoration.
The algorithm is the part nobody gets wrong any more. Standard ciphers are free, well studied, and built into every platform. Naming one distinguishes an operator from nobody.
Key custody is the entire question. Who holds the key, where it is held, and whether the operator can use it without your device present. A page that names a cipher and says nothing about who holds the key has answered the easy half loudly.
“Bank-grade” and similar phrases mean nothing technical. They are comparisons to an unnamed standard. The same applies to “military-grade” and to “military-strength”. If a phrase cannot be checked against a definition, it is a mood rather than a claim — the general habit of unpacking words like “private” and “secure” is covered in AI chatbot, assistant, companion: what the words actually mean.
Audits and certifications describe process, not content
The other common furniture on a security page is a certification badge or a reference to an independent audit.
These are almost always about organisational process — that the company has documented controls, restricts internal access, logs administrative actions, reviews vendors, and so on. That is worth something: it is evidence of a company that has thought about the problem and been examined by an outsider.
They are not statements about what the company does with your conversations. A well-audited operator can still retain everything indefinitely, use it for training, and let staff read it, all inside its certified process, because those are policy choices rather than control failures.
So read the badge as evidence of competence and the policy as evidence of intent. They answer different questions. The intent half is where the checkable clauses live, and how to find them is set out in how to read a companion app’s privacy policy.
What encryption cannot help with at all
Even a perfect set of server-side claims leaves the exposures that most often actually bite, because they happen on your side of the connection.
Anything displayed on your screen is readable by anyone looking at your screen, and anything you screenshot becomes an ordinary image in your photo library.
Notification previews put content on a locked screen regardless of how it was stored.
Local copies and backups live under your platform account’s protection rather than the app’s. What would genuinely change the server-side picture — processing that never leaves the device — is described, along with how to recognise a real claim of it, in what on-device processing would look like.
So the honest summary of a typical security page is: the transport is fine, the storage is reasonably guarded, the operator can read your conversations, and the limit on what leaks is what you chose to send. That is not a scandal. It is just considerably less than the word “encrypted” is doing there.