Message bodies
Message bodies are encrypted before leaving the sender's client and remain encrypted in the browser's persisted room state. The active client decrypts them into transient UI state only when preparing the conversation for display.
E2EE + AWS serverless
End-to-end encrypted messaging on serverless AWS.
Diaktor encrypts messages and attachments between participating clients while the messaging backend and data plane run in the customer AWS account. Matrix-compatible cryptography protects content; serverless infrastructure provides an independent layer of elastic operation and customer control.
- Messages + attachments
- Client-side encryption
- Customer-owned AWS deployment
- 01 / SENDING CLIENTEncrypt before sending.
Messages and attachments are encrypted on the client.
- 02 / TRANSPORT + STORAGECarry encrypted content.
Messaging services transport and store ciphertext.
- 03 / RECEIVING CLIENTDecrypt for display.
Participating clients use the required keys to read the content.
Content privacy
Encryption happens at participating clients.
The Diaktor web client uses matrix-sdk-crypto for Matrix-compatible
end-to-end encryption. Content is encrypted before it is handled by the messaging
backend and decrypted by participating clients that hold the required cryptographic
material.
Attachment content
Attachment payloads follow the encrypted content path, so files remain encrypted while transported and stored by backend services.
Federated rooms
Encrypted content remains protected when Matrix federation carries room events across organizational and homeserver boundaries.
Defense in depth
E2EE and AWS controls protect content and infrastructure together.
Diaktor combines two complementary security layers. Matrix-compatible E2EE protects readable communication content before it leaves participating clients. The customer-owned AWS environment protects the runtime and data plane with identity, transport, storage, monitoring and governance controls.
Communication content
- Message bodies encrypted between participating clients
- Attachment payloads encrypted before upload, transport and storage
- Encrypted room content crossing Matrix federation boundaries
- Client-side cryptographic processing and key handling
The current crypto SDK also supports encrypted state events, providing a path to extend this protection as Diaktor adopts those event types.
Runtime and customer data plane
- Dedicated deployment boundary in the customer's AWS account
- IAM authorization for service and operational access
- DynamoDB and S3 encryption at rest, with TLS in transit
- CloudWatch monitoring, logging and configurable retention
- Customer-controlled account policies and governance
Together, these layers provide defense in depth: E2EE keeps communication content unreadable to the backend, while AWS controls protect the services and data plane that transport, process and store encrypted payloads. Customer endpoint and AWS-account policies complete the operational security model.
Independent layers
E2EE for confidentiality. Serverless AWS for control and scale.
Encryption and serverless infrastructure solve different problems. E2EE protects message and attachment content between clients. The AWS deployment model determines where backend services, event state, attachment payloads, logs and operational controls run.
Diaktor combines them by installing runtime services and data stores in a dedicated customer AWS account. Managed services respond elastically to workload within configured quotas and limits, while the organization retains direct ownership of its deployment boundary.
Matrix under the hood
Privacy without requiring buyers to be Matrix specialists.
An organization can evaluate Diaktor as a secure messaging product without first
adopting Matrix terminology or operating a conventional homeserver. Matrix matters
because it supplies a proven cryptographic and federation foundation: the Diaktor web
client uses matrix-sdk-crypto, while server-server compatibility provides
interoperability with the wider ecosystem.
Implemented client operations use standard Matrix client-server contracts and event
formats. Diaktor changes the synchronization channel rather than the messaging protocol:
AWS AppSync Events WebSocket push replaces long-polling /sync, so the product
includes and requires the Diaktor web client. Federation independently uses the standard
Matrix server-server API without protocol conversion.
Where it fits
A secure communication layer for products and organizations.
Private organizational messaging
Customer-hosted communication where content confidentiality and infrastructure ownership are explicit requirements.
Regulated communication products
A foundation for domain systems that add identity, directory, policy and workflow layers around encrypted messaging.
Federated partner networks
Cross-organization rooms and messages that retain E2EE while interoperating through Matrix federation.
Privacy questions
What E2EE means in practice.
Are attachments end-to-end encrypted?
Yes. The Diaktor web client applies the encrypted content path to attachment payloads as well as message bodies, so backend transport and storage handle encrypted content.
Can an infrastructure operator read messages?
The E2EE design does not require the messaging backend to hold plaintext content keys. Readable content remains at participating clients unless an endpoint or authorized client is compromised.
Does E2EE hide all metadata?
No. Operational metadata such as identities, room membership, routing and timing may remain visible where needed to operate the service. Its exact scope depends on configuration and features.
Does serverless make encryption stronger?
No. E2EE and serverless architecture are independent. Diaktor combines content confidentiality with elastic operation and customer ownership of the AWS deployment.
Early access · Planned from October 2026
See end-to-end encrypted messaging in action.
Start with a free demo of E2EE, real-time delivery and Matrix federation. Planned beta deployments use fixed onboarding and an annual subscription paid monthly, with support benefits for eligible early adopters. Explore early access.
Request a demo