Security

Security and transparency

This page exists so you do not have to take our word for anything. It covers how to report a problem, what has and has not been reviewed by people outside the project, exactly what our server holds about you, and every legal request we have received.

Responsible disclosure

Reporting a vulnerability

If you have found something, write to contact@chatit.ro with SECURITY in the subject line. Please do not open a public issue or post about it before we have had a chance to ship a fix.

What helps in a report

  • The platform and app version you tested, iOS or Android, as shown in Settings.
  • Steps to reproduce it, as precisely as you can manage.
  • What an attacker would actually gain if the issue were exploited.

In scope

  • The Chatit mobile apps for iOS and Android.
  • The signalling server and the API behind it.
  • This website and everything else under chatit.ro.

Out of scope

  • Denial of service, traffic flooding, and anything that degrades the service for other users.
  • Output from an automated scanner with no working proof behind it.
  • Social engineering aimed at us, at our users or at our suppliers.

What happens next

Chatit is maintained by one person, so there is no security team on rotation. You will get a first reply within five working days. If the issue is real, we will tell you what the fix looks like and roughly when it ships.

There is no paid bug bounty. We cannot fund one honestly at this stage, so we are not going to advertise one. What we can offer is credit on this page once the fix is out, if you want it.

Safe harbour

If you report something privately and in good faith, we will not take legal action against you. That holds as long as you stay within your own accounts and test data, do not degrade the service for anyone else, and give us reasonable time to ship a fix before you publish.

Independent review

Audit status

Independent security auditNot yet carried out

Chatit has not been through an independent security audit. We would rather write that plainly than let you assume otherwise.

The cryptographic primitives are not ours. Chatit uses X25519, XSalsa20 and Poly1305 through TweetNaCl, which has been reviewed extensively by people far better qualified than us. What nobody outside the project has reviewed is the way Chatit puts those pieces together: the key exchange, the ratchet, session handling and local storage.

That is the real gap, and it is worth knowing about before you trust the app with something sensitive. When an audit is done, the report goes on this page, findings included.

Transparency

What the server actually holds

This is the complete list. Everything else, including the content of your messages and calls, exists only on the devices taking part in the conversation.

Anonymous IDGenerated on your phone. It routes messages to you and is not tied to an email address, a phone number or a real name.
Public keySo other people can encrypt messages addressed to you. The private key never leaves your device.
Display name, optionalOnly if you set one. You can leave it empty and the app works exactly the same.
Push tokenSo your phone can be woken for an incoming message or call. It carries no content.
Undelivered messagesEncrypted, and kept only until your device confirms delivery. Anything still undelivered after 30 days is deleted automatically.
Aggregate countersTotals such as messages delivered and calls placed. They count events and say nothing about who was involved.
Legal requests

Requests for user data

Legal requests received to date

0

As of August 7, 2026

The figure above covers every request for user data from a court, a prosecutor, a police force or a supervisory authority since launch. It is updated whenever it changes.

What we could hand over if we were legally required to

  • The items in the table above, for the account named in the request.
  • Whatever our suppliers hold in their own right. The servers are in the European Union, the website sits behind a CDN, and push notifications travel through Apple and Google. Those companies answer requests independently of us, and we cannot speak for them.

What we could not hand over, whoever asked

  • The content of any message or call. It is encrypted end to end and we do not hold the keys.
  • Your conversation history. It lives on your device and your contact's device, never on our server.
  • Your secret phrase. It is generated on your phone and never reaches us.

None of this says anything about what the law can require of us. It describes what we are physically able to produce, which is the part that actually protects you.

Operator

Who runs this service

Chatit is operated by the company below, registered in Romania and acting as data controller under the GDPR.

INNOVATEX DESIGN SRL

Company ID (CUI)48509212
Registered officeRomania, Cluj county, Dej, Strada 1 Mai no. 41
General and privacy contactcontact@chatit.ro
Security reportscontact@chatit.ro
Supervisory authorityANSPDCP, www.dataprotection.ro

A machine-readable version of this disclosure contact is published at /.well-known/security.txt, following RFC 9116.