🔒 Secure Messaging (E2EE)

Secure Messaging Hero

Welcome to your sanctuary for private connection. Our End-to-End Encrypted (E2EE) messaging system ensures that your most personal conversations and notes remain strictly between you and your client.

By utilizing state-of-the-art cryptographic standards, we ensure that no one—not even the LightStack team—can read your secure messages or view your private files.

🌿 The Philosophy of Privacy

Privacy isn’t just a setting; it’s a foundation of trust. Our E2EE system works by encrypting your data directly on your device before it ever reaches our servers.

Your device is the key: Only you and the intended recipient have the keys to unlock the content.
Personal Responsibility: Security is a shared responsibility. We have build these tools for you to use with integrity and care. Your part is to protect your PIN and Recovery Phrase. Without these, you will not be able to access your data.
No “Middle Man”: Because the encryption happens in your browser, the “ciphertext” stored in our database is unreadable to anyone without your personal PIN.
Sovereign Data: You hold the power over your information. We will never share your private message with anyone, beacuse we will not be able to.

✨ Getting Started

To begin using secure messaging, you must first enroll in the E2EE system.

1. Enrollment

Navigate to your Security Settings to begin the process. You will be asked to create a 6-digit Security PIN.

2. Your Security PIN

Your PIN is used to derive your encryption keys.

Important

We never store your PIN. It stays only in your mind and is used locally in your browser to unlock your workspace. If you forget your PIN, we cannot reset it for you.

3. The Recovery Phrase

During enrollment, you will be given a 24-word Recovery Phrase.

Caution

This phrase is the only way to regain access to your encrypted data if you forget your PIN or lose access to your device. Store it in a safe, offline place (like a physical safe or a password manager).

🛠️ Daily Practice

Once enrolled, you can start sending and receiving secure messages.

Unlocking your Workspace

When you navigate to a secure note or message, you will see a prompt to enter your PIN. This “unlocks” your session, allowing your browser to decrypt and display the content.

Secure Notes & Files

Booking Notes: Practitioners can write private, encrypted notes on any booking. These notes are only visible to you.
Encrypted Files: Any files uploaded through the secure file portal are encrypted before upload, ensuring total data protection.

PIN for Decrypting Messages

While passkeys are a secure and passwordless way to log in, you might notice a warning indicator next to a registered device stating that a PIN is required to decrypt messages.

This situation occurs because your device’s biometric authenticator (such as Touch ID or Face ID) does not support cryptographic key wrapping via the WebAuthn PRF (Pseudo-Random Function) extension.

Why is a PIN needed?

For maximum privacy, your end-to-end encrypted messaging keys are locked using your Security PIN. Devices that support PRF key wrapping can securely store a derivative of these encryption keys in their hardware security module, allowing you to unlock your encrypted messages directly using biometrics.

If your device does not support this extension, you can still use the passkey to sign in passwordlessly, but you will need to enter your 6-digit Security PIN to decrypt and read your messages.

Device & Operating System Compatibility

Support for cryptographic key wrapping depends on your operating system and browser version:

Apple macOS: Supported on macOS 15 (Sequoia) and later via iCloud Keychain, using Safari 18+ or Chrome 132+. macOS 14 (Sonoma) and earlier do not support PRF key wrapping with platform passkeys.
Apple iOS & iPadOS: Supported on iOS 18 & iPadOS 18 and later via iCloud Keychain and Safari 18+. iOS 17 does not support the PRF extension.
Windows: Supported on Windows 11 using Windows Hello with modern web browsers (Chrome, Edge).
Android: Supported on Android 14 and later via Google Password Manager in Chrome.

If you are using an unsupported device or operating system version, you can upgrade your system software to enable biometric message decryption.

🆘 Recovery and Safety

What if I forget my PIN?

If you forget your PIN, you can use your 24-word Recovery Phrase on the enrollment page to reset your PIN and re-access your data.

Locking your Session

For maximum security, your encryption keys are wiped from memory when you log out or close your browser tab (depending on your configuration). You will be asked to re-enter your PIN the next time you need to access secure content.

Shared Responsibility

While we provide the tools for absolute privacy, the safety of your data depends on:

Choosing a unique PIN.
Keeping your Recovery Phrase safe.
Ensuring you log out on shared devices.