Android
Direct APK for Android 7+, no Google Play Services, auto-update from our server.
Verifiable security
Check us. Don't trust us.
Every security claim Edel makes is tied to an artifact you can download and check: a signed web manifest, an APK hash, a server build endpoint, an RFC 9116 security contact. This page also lists what we do not claim.
RU: каждое утверждение о безопасности привязано к артефакту, который можно скачать и проверить. Ниже честно перечислено и то, чего у нас нет.
Ed25519Manifest signature
SHA-256Per-file hashes
RFC 9116security.txt
Fail closedClient refuses mismatch
Claims
Claim → artifact → how to check
If a claim has no artifact here, it is not a claim we make.
| # | Claim | Artifact | How to check |
|---|---|---|---|
| 1 | The web client is exactly the published code | /manifest.json, /manifest.sig | Verify the Ed25519 signature, then hash every .js/.mjs/.html |
| 2 | The browser verifies the client before running it | web/src/integrity.js | Read verifyStatic(): signature first, hashes second, fail closed |
| 3 | The APK is the published build | GET /api/v1/version | Download /api/apk/file, compare SHA-256; the app pins the signing certificate |
| 4 | The server is alive and reports its build | GET /api/health | Read status, version, build |
| 5 | Messages are encrypted on the device | testvectors/v1.json, charter §4/§6 | Reproduce the envelope with the published vectors (Go/Kotlin/JS) |
| 6 | Offline messages are deleted after a signed ACK | charter §8/§13.11 | Read the invariant; covered by server tests and the e2e harness |
| 7 | Requests are signed; replay and forgery are rejected | charter §6, server/internal/crypto | Read the protocol and the server implementation |
| 8 | The APK does not depend on Google Play Services | AndroidManifest.xml, Gradle, live APK | Inspect the manifest/APK; install without GMS |
| 9 | Access is paid and invite-only | GET /api/v1/price, legal.en.html | Fetch the live price snapshot; read the Terms |
| 10 | Tokens are not sold as access | charter §7.9/§7.11, legal.*.html | Read the legal texts; no token is accepted for access |
| 11 | There is no iPhone app, by policy | charter §1.1.1/§17, #ios | Read the policy; no iOS binary is published |
| 12 | A security contact exists | /.well-known/security.txt | Fetch it (RFC 9116) |
Reproduce
Verify the web client in four steps
- Fetch the manifest.
GET https://edel.chat/manifest.json→{"version":"…","files":{"path":"sha256 hex"}}. - Fetch the signature.
GET https://edel.chat/manifest.sig→ base64 Ed25519 signature over the exact manifest bytes. - Verify with the pinned key.
crypto_sign_verify_detached(sig, manifest, key)wherekey = dlCB6TeyJ3fRdbbY4rcIQQ5Qv0A4wAauJwUSFKhivTM=. The same key is inweb/src/server-pub.js. - Compare hashes. For every file matching
\.(m?js|html)$/, download it and checksha256(bytes) == files[path]. Any mismatch means the official client refuses to run.
APK: GET https://edel.chat/api/apk/file, compute SHA-256, compare with sha256 from GET https://edel.chat/api/v1/version.
Honest limits
What we do not claim
- No third-party audit yet. Only an internal self-audit and a remediation plan exist.
- The source repository is private. We do not claim "open source". Verifiability here means the signed manifest, the APK hash and the build endpoints.
- No bug bounty.
- Accepted residual risk: whoever controls the initial HTML controls the verifier too; the manifest protects the executable module graph, not the first byte of HTML.
- Metadata is visible to the server (who talks to whom, when; coarse presence). Content, names and keys are not.
- No FCM/background push and no group chats. Delivery while the app is closed is not guaranteed.
Platforms
Android and web. No iPhone app.
Web
Any modern browser; keys stay on your phone; QR pairing.
iPhone
No app, by policy. Our threat model requires an OS we control and can reason about. Documented cases of data access at the OS level make iOS unsuitable for confidential messaging. This is the project's assessment, not an accusation against Apple. The web client remains usable in Safari.
Access
Paid, one-time packages — not a subscription
Access is paid and invite-only. Packages are one-time purchases: 2, 5 or 10 invitation codes, paid in USDC or USDT on Base directly to the treasury. There is no recurring membership fee. The money funds development and support. Live prices: GET /api/v1/price.
This is not an investment product: no income, buyback or liquidity is guaranteed. Terms · Privacy · Risk · Referrals
Contact
Security and abuse contacts
- Security reports: [email protected]
- Mail/postmaster: [email protected]
- Abuse: [email protected]
- DMARC reports: [email protected]
- Machine-readable: /.well-known/security.txt