App Security Brief.

Prepared 2026-08-18 · Buildable Labs Studio · for investor diligence

The one-line summary: Whist runs real end-to-end encryption today — OpenMLS (RFC 9420) over a relay that only ever carries ciphertext — and every claim in the product is labeled to exactly match what is built. What is not yet true (an audit of our integration, multi-device) is stated below, not hidden.

How this brief works

Each security property is listed with its current status and the evidence behind it. We invite technical review: the fastest way to verify Whist is to check that the app never claims more than this table does.

Claims ledger

PropertyStatusEvidence
End-to-end encryptionLIVE · BETAMessages sealed with OpenMLS (RFC 9420) on-device; proven between two physical devices over the production relay. In-app label: “beta, unaudited” — the qualifier ships with the claim.
Server blindnessLIVEThe relay (Cloudflare Worker, EU region) stores opaque ciphertext envelopes with a 30-day TTL. Live wire-taps during development show no plaintext at any point server-side.
Encryption at restLIVEMessage store is SQLCipher (AES-256). Verified empirically: random file header, sqlite3 cannot open the database, no plaintext recoverable from the file.
Hardware-backed keysLIVECurve25519 identity key + Secure Enclave P-256 device key, Keychain-held (WhenUnlockedThisDeviceOnly). Exercised on physical hardware 2026-08-18.
Authenticated APILIVEEvery relay request is Ed25519-signed with the registered identity key; the server enforces sender = signer. Replay protection via nonces.
Contact verificationLIVEPairwise 60-digit safety numbers (Signal's iterated-SHA-512 construction). Peer keys are trust-on-first-use; a changed key automatically revokes the thread's verified state.
Real deletionLIVEDisappearing messages are purged from the encrypted store (≤60 s sweep), with VACUUM so rows do not survive in free pages; media ciphertext is deleted from the relay.
Independent auditIN MOTIONOur cryptographic core (OpenMLS) was audited by SRLabs, May 2026. Our integration has not yet been reviewed; a scoped engagement is being commissioned (Cure53 / Trail of Bits / Radically Open Security inquiries prepared 2026-08-18).
Multi-device & key backupDESIGNEDDeliberately not built yet — this is where E2EE products fail when rushed. Design doc v0 exists (signed device lists, QR device vouching, blind encrypted backup with a user-held recovery code).
Push notificationsPLANNEDBeta transport is foreground polling. APNs integration is scheduled with a privacy review of what notification metadata may reveal.

What we deliberately do not claim

No audit of our integration has completed yet — so the product says “beta, unaudited” wherever it says “end-to-end encrypted.” Accounts are single-device with no recovery: losing the device means losing the account, and the UI says so rather than implying a guarantee. Messages delivered to another device cannot be recalled, and the interface states this limit. SMS verification does not exist server-side; the app says exactly that.

This discipline is the product thesis: the copy is generated from what the code does, never ahead of it.

Architecture in one paragraph

A SwiftUI iOS client holds all keys. Message encryption is OpenMLS (MIT-licensed, Rust), bridged via a thin FFI wrapper; per-conversation MLS groups handle 1:1 today and grow to teams. The relay is a Cloudflare Worker + D1 in the EU (api.whistapp.com) that registers devices, hands out one-time key packages (atomic claim), and forwards ciphertext envelopes it cannot read, deleting them after delivery or 30 days. Media is encrypted client-side (AES-256-GCM, fresh key per file) before upload; the per-file key travels inside the E2EE message.

Stack provenance

OpenMLS

MIT · RFC 9420 · SRLabs audit 05/2026 · also used by Wire, XMTP, Cloudflare

SQLCipher

BSD-3 · AES-256 full-database encryption, community edition

Apple Secure Enclave

Hardware key isolation; P-256 device key non-exportable

Cloudflare Workers + D1

EU region (EEUR) · no plaintext ever present to encrypt-at-rest questions

For your technical reviewer

  • Proxy the app’s traffic: every payload to api.whistapp.com is a signed request whose message bodies are MLS ciphertext.
  • Pull the app container: the message database file has no SQLite header and rejects standard tooling.
  • Compare the app’s claims against this ledger — they are written to match exactly, including the qualifiers.
  • Full audit scope document and codebase access available under NDA on request.

Whist · Buildable Labs Studio · Founder: Dominic Suditu · [email protected]
This brief states the verified status of the product as of 2026-08-18 and is updated as statuses change.