End-to-End Encryption in Liman
Liman provides end-to-end encryption (E2EE) for chat messages (Matrix) as well as for 1:1 video calls and video meetings.
Group meetings: Unlike Microsoft Teams, meeting E2EE in Liman is not limited to 1:1 calls. Group video meetings can also use end-to-end encryption when it is explicitly enabled (see the section below).
Sprache / Language: Deutsch
What is End-to-End Encryption?
With end-to-end encryption, content is encrypted before it is sent and only decrypted by the recipient. Only the conversation participants can read the data – no one else, including the infrastructure operators, has access.
E2EE for Chat Messages (Matrix)
All chat messages in encrypted rooms are end-to-end encrypted (Megolm protocol, Rust Crypto). Whether encryption is used at all is an organization admin policy, not a per-user setting.
Default: off. New organizations and hosted Liman Matrix (OIDC) start without Matrix E2EE: no crypto on login, no “Not encrypted” shields, no security onboarding wizard. Transport encryption still applies.
Exception — existing Synapse or Tuwunel: If an admin connects an existing homeserver (Account → Team → Services → “Own server”, or setup wizard “own Matrix server”), Liman turns encryption on. Those servers often already have encrypted rooms. Admins can still turn it off under Security policies.
Automatic Setup (only when E2EE is on)
When Matrix E2EE is enabled for the organization, SPARKS automatically sets up on first login:
- Secret Storage – secure key management
- Cross-Signing – device verification
- Key Backup – backup of your encryption keys
No manual action required – everything happens in the background.
Encrypted Rooms
- New rooms can be created as encrypted (option when creating the room).
- Existing rooms can be encrypted later: Room settings → Privacy → “Enable encryption for this room”.
- In encrypted rooms, all messages are E2EE; only participants with the correct keys can read them.
Verify Liman with Element
If you use Liman alongside Element (or connect your own homeserver), compare devices via emoji/numbers: Connect your Matrix server and verify Liman.
Second Device (Browser or Desktop App)
When you sign in on an additional device, your encryption keys are automatically restored:
- The recovery key is securely fetched from the server
- Secret Storage is opened with the existing key
- All older messages become decryptable
- The new device is automatically verified
No manual action needed – your messages are readable immediately.
Recovery Key
The recovery key is your emergency key in case automatic restoration doesn't work:
- It is stored securely on the server by default (AES-256-GCM encrypted)
- You can optionally copy/save it during the setup wizard
- It is displayed in Element-compatible format (can be entered in Element)
Strict Device Verification (Admin Option)
Your organization administrator can require that the recovery key is not stored on the server. In that case:
- You must save the recovery key yourself when first setting up
- You must manually enter the key or verify via SAS/QR on each new device
- The wizard will display the key and require confirmation that you saved it
Matrix E2EE as an organization policy (Admin)
Admins control encryption under Account → Team → Security policies (Matrix end-to-end encryption). Members do not have a separate toggle in app Settings.
| State | Behavior |
|---|---|
| Off (default) | No new encrypted rooms; crypto is not initialized on login; encryption hints in unencrypted chats are hidden |
| On | Members can use encrypted rooms; crypto and optional security onboarding on login |
| On (existing homeserver) | Automatic when an existing Synapse/Tuwunel server is connected; the admin can still switch to Off |
When encryption is off:
- E2EE-related options in the app are hidden (create room, security setup, “Start encrypted” on events, and similar)
- Device verification policy (comfortable/strict) does not apply
Admin details: Team management – Security policies.
E2EE for 1:1 Calls
When E2EE is enabled for 1:1 calls:
- Audio: Your voice transmission is end-to-end encrypted.
- Video: Your video stream is end-to-end encrypted.
- Screen sharing: Shared view is also end-to-end encrypted when enabled.
Liman uses an integrated video infrastructure for calls and meetings with support for end-to-end encryption.
Activation (1:1 Calls)
- Open Settings → Privacy
- Find the option End-to-end encrypted calls
- Toggle the switch on or off as desired
Important: For a 1:1 call to be end-to-end encrypted, both participants must have E2EE enabled.
E2EE for Video Meetings (Group Meetings)
Video meetings (group meetings) run by default without meeting E2EE. E2EE for meeting audio/video is only used when it is explicitly enabled – either via the calendar or via room settings.
When is a meeting E2EE-encrypted?
- Calendar appointments: When creating or editing an appointment, the organizer can set the option “Start encrypted” (or
startE2EEncrypted). The associated meeting chat is then created as an encrypted Matrix room, and the meeting uses a shared E2EE key (via Matrix room state). - Chat rooms (call from chat): In encrypted rooms, admins/moderators (power level ≥ 50) can enable or disable the option “Meeting end-to-end encryption” under Room settings → Privacy. Only when this option is on are calls/meetings from this room E2EE-encrypted.
Flow (calendar meeting with E2EE)
- Organizer creates an appointment with “Start encrypted”.
- When the meeting chat is opened for the first time, an encrypted Matrix room is created.
- When joining the meeting, the app fetches the shared meeting E2EE key from the Matrix room (or generates it on first join and stores it there).
- Audio and video in the meeting are then end-to-end encrypted.
Guests
Guests (participants without Matrix login, e.g. joining only via meeting link) have no access to the E2EE key. For them, the meeting runs without meeting E2EE (transport encryption still applies).
Where to find the settings
- Calendar: When creating/editing an appointment – option “Start encrypted” (if offered by the product).
- Chat room: Open room → Settings (gear) → Privacy tab → “Meeting end-to-end encryption” switch (only visible in encrypted rooms and only for admins/moderators).
Without E2EE
When E2EE is not enabled, calls and messages in Liman are still transmitted with transport encryption. Your data is protected during transmission and at rest.
Decision guide: what does E2EE actually change?
Liman separates three layers. Decide per layer — “everything on” maximizes privacy but is not right for every team or feature.
| Layer | Who controls it? | Typical question |
|---|---|---|
| Matrix chat E2EE (rooms) | Org admin (on/off) + room creator | Should chat content be readable only on participants’ devices? |
| Meeting E2EE (audio/video) | Organizer / room moderators (explicit) | Should meeting media also be end-to-end encrypted? |
| Device verification (Comfortable / Strict) | Org admin (only when Matrix E2EE is on) | May the recovery key live on the server, or only with users? |
Snapshot: benefit vs. limitation
| Topic | With E2EE | Without E2EE (transport encryption only) |
|---|---|---|
| Confidentiality | Operator/homeserver cannot read message or meeting media content | Infrastructure could theoretically see content (access control and policies still apply) |
| In-app assistant | In encrypted rooms: messages are often only readable locally; server-side chat content analysis is not possible | Plaintext events can be read by client tools and (when wired) server-side |
| Livedata MCP (external AI) | Scope matrix: E2EE events are returned as unavailable (unavailable: e2ee) | Unencrypted room messages can be read via MCP (with API key + scope) |
| Recording / transcript / captions | With meeting E2EE, typically unavailable or heavily limited | Meeting features such as recording and transcript work (subject to plan/policy) |
| Guests in meetings | Without Matrix login: no meeting E2EE key → guests join without meeting E2EE | Guests join via link as usual |
| Device change / support | Strict: keep the recovery key yourself; loss may lock old messages. Comfortable: easier setup; key stored encrypted on the server | No crypto setup required |
| Compliance / eDiscovery | IT/server cannot content-inspect historical chats | Easier server-side retention/inspection if the operator offers it |
Recommendations by scenario
| Scenario | Recommendation |
|---|---|
| Confidential 1:1 or project chats | Turn Matrix E2EE on (org policy); create encrypted rooms |
Org wants AI over chat content (assistant room context, MCP matrix) | Use unencrypted work rooms or turn Matrix E2EE off org-wide — and document the tradeoff deliberately |
| Standard team meetings with recording/transcript | Start the meeting without meeting E2EE; transport encryption remains |
| Highly sensitive meetings (no guests, no recording) | “Start encrypted” / meeting E2EE on; do not expect recording/transcript |
| Many devices, little IT support | Matrix E2EE on + Comfortable policy |
| Maximum key control, trained users | Matrix E2EE on + Strict policy (recovery key offline) |
For admins (Team → Security policies)
- Matrix E2EE Off (default): The default for hosted Liman Matrix: easier integration (including server-readable chats for assistant/MCP), no encryption hints in everyday chat. Transport encryption remains. Turn it on under Security policies when needed.
- Matrix E2EE On: Strongest chat protection; AI/MCP cannot see message bodies in encrypted rooms. Typical for an existing Synapse/Tuwunel server (those often already have encrypted rooms) or when confidentiality outweighs AI over chat.
- Comfortable vs Strict: Only when E2EE is on. Comfortable eases onboarding; Strict avoids server-side recovery-key storage and increases support load.
How to switch: Team management – Security policies. External AI keys: Account → AI access / MCP.
For users
- Room E2EE and meeting E2EE are not the same. An encrypted chat does not automatically mean an E2EE meeting — and vice versa.
- If the assistant “cannot see messages” from a room, the room is often E2EE; that is intentional, not an AI bug.
- Under Strict, keep the recovery key offline; losing it can make old messages unreadable.