Security in Prisma: what we can see and what we cannot
Last updated: 8 October 2026
This page is not marketing copy; it describes how the system actually works today. When something
changes, this page changes first.
In short: private chats between Prisma users are end-to-end encrypted;
we cannot see their content. WhatsApp chats are different, because WhatsApp's own encryption ends at the
bridge: the bridge sees a message while passing it on to Prisma, but we do not read it, we do not keep it,
and on our server it exists only encrypted. Details and limits below.
1. Prisma chats: end-to-end encryption
- Direct chats and private rooms are created end-to-end encrypted (Matrix Olm/Megolm).
Keys are made and kept only on the participants' devices; our server carries and stores ciphertext.
- Public rooms are not encrypted: in a room anyone can join, encryption protects nobody. Creating a
room says so plainly.
- What the server sees (metadata): who is in which room, when messages were sent, device names and IP
addresses. Not content.
- Connections use TLS and pass through Cloudflare; Cloudflare cannot read end-to-end encrypted messages
either.
2. Device verification
When you sign in on a new device you verify it with an old device or your recovery key. Verified
devices can read your encrypted history; you are warned when an unverified device appears. You can verify
a contact's devices by comparing them in person or over a channel you trust.
3. Key backup and recovery key
Your encryption keys can be backed up to the server, encrypted with a recovery key only you know. We do
not have it: if you lose it and are signed out everywhere, we cannot bring old encrypted messages back.
4. Identity change warning
If the encryption identity of someone you talk to changes (for example they reset their recovery key),
Prisma warns you. If you did not expect it, check with them over another channel.
5. History sharing
Someone who joins a room can only read encrypted messages from before they joined if a member shares
the keys with them. By default, history is visible from the moment they were invited.
6. WhatsApp chats
When you connect WhatsApp, a bridge running on our server joins WhatsApp as one of your linked devices.
The honest consequences:
- WhatsApp's end-to-end encryption ends at the bridge. To pass a message on, a bridge
has to decrypt it; that is true of every WhatsApp bridge that runs on a server.
- The bridge encrypts the message for Prisma. WhatsApp chat rooms are end-to-end
encrypted: the bridge encrypts each message with its own encryption device, and only ciphertext reaches
the server's database. A copied database shows nothing readable.
- We do not keep it. The bridge holds a message only until it is in Prisma: text and
files are deleted at most 5 minutes after delivery, and a message that could not be delivered within 7
days. Your PrismAI chat lives on your phone; the server's copy is deleted after a day. Old bridge backups
and the WhatsApp history from before encryption have been deleted from the server.
- We do not read it. No member of staff and no system of ours looks at message
content; the bridge and server logs do not record it.
- The limit: because the bridge runs on our server, "we do not read it" is a promise,
not a technical impossibility. Someone with access to the server could change the bridge and see
messages as they pass. The way to make it impossible is a bridge that runs on your phone; we are working
on it and this page will say so when it is done.
- There are no voice or video calls in WhatsApp chats; the bridge carries messages only.
7. PrismAI
PrismAI works through Meta AI on WhatsApp. What you write to PrismAI goes to Meta through WhatsApp and
is subject to Meta's terms. Do not share sensitive information.
8. Photo Roulette: your gallery
- Nothing leaves your gallery without your approval: only you see the photos and videos proposed
before a game, and only what you approve is sent.
- What is sent is end-to-end encrypted on your phone; the key exists only on the phones of the players
in the room. The Photo Roulette server and its operators - us included - cannot open or see
the content, during the game or afterwards. The encrypted data is kept in memory only and deleted as
soon as it is done with.
- Everyone in the game sees the pool without owners and can exclude anything. The screen shows a
12-digit room security code; if it matches for everyone, nobody got in between.
- Details: Photo Roulette privacy notice.
9. The app and its downloads
- Download Prisma only from prismas.net. The download section shows the APK's SHA-256
fingerprint; the app checks its own updates against it, and Android only accepts an update signed with
the same certificate.
- Library apps (Guide, Photo Roulette...) are installed by Prisma after checking their fingerprint and
signature.
- Bug reports are currently off; app logs are not sent anywhere.
10. Your account and data
In Settings you can close your account for good and manage your recovery key. To end sessions left
open on other devices, for now message @administration in the app; an in-app screen for
it is on the way. Details are in the privacy notice. If you find a
security problem, message the same account.