By J DV. Independent security researcher exploring cybersecurity, privacy, and secure system design.
People often assume that if a messaging app offers end-to-end encryption their conversations are completely private. Encryption is undoubtedly one of the strongest security technologies available today but privacy extends far beyond protecting the content of a message.
Modern messaging platforms still generate metadata, rely on cloud infrastructure and interact with operating systems in ways that can expose information about users. This article explores why encryption alone is not enough examines the broader privacy challenges facing digital communication and discusses the principles that should guide the next generation of privacy-focused technologies.
I. End-to-End Encryption Protects Messages, Not Everything
For years, end-to-end encryption (E2EE) has been presented as the gold standard for private communication. It ensures that only the sender and the intended recipient can read the contents of a message, preventing intermediaries from accessing it during transmission. This has significantly improved the security of modern messaging platforms and raised the baseline for protecting digital conversations. However, equating end-to-end encryption with complete privacy creates a misleading impression of how modern communication systems actually operate.
II. Metadata Can Reveal More Than the Message Itself
While end-to-end encryption protects the contents of a message, it does not eliminate the digital traces created around every interaction. These traces, commonly known as metadata, include information such as who communicated with whom, when the communication occurred, how frequently it happened, and, in some cases, the approximate size or type of the exchanged data. Although metadata does not reveal the actual message, it can still provide a detailed picture of a person's communication patterns and relationships.
III. Privacy Depends on the Entire Ecosystem, Not Just Encryption
Modern communication does not take place in isolation. Every message exists within a broader ecosystem that includes operating systems, cloud services, notifications, backups, connected devices, and the servers responsible for delivering communications. While end-to-end encryption protects the contents of a message, messaging platforms still need to process certain metadata—such as routing information, timestamps, or other operational data—to provide their services. The type of metadata collected and how long it is retained varies between platforms, but users often assume that only they and their device know about their conversations. In reality, privacy depends not only on message encryption but also on how the surrounding ecosystem and service infrastructure handle communication data.
IV. Privacy Ultimately Depends on Trust, Transparency, and Design
Strong encryption creates a powerful barrier against attackers attempting to intercept the contents of a conversation during transmission. However, encryption alone does not define the entire privacy model of a messaging platform. Even services such as WhatsApp, Signal, Telegram, and other modern messaging platforms rely on server infrastructure to authenticate users, route messages, exchange encryption keys where applicable, and process operational metadata required for service delivery. Although end-to-end encryption is intended to prevent service providers from accessing message contents, the overall privacy experienced by users also depends on how each platform collects, processes, and retains metadata, manages its infrastructure, and handles user data outside the encrypted message itself. Evaluating privacy therefore requires examining the complete system rather than relying on a single security feature or marketing claim.
V. Privacy Cannot Be Measured by Encryption Alone
Once the limitations of end-to-end encryption are understood, the next step is to examine what actually defines a private communication system. Encryption is a critical security technology, but it represents only one layer of a much broader privacy architecture. A realistic evaluation of any messaging platform requires looking beyond encrypted message content and assessing how the entire system operates.
A modern messaging platform can be evaluated across four fundamental layers.
The first layer is message protection. End-to-end encryption ensures that the content of a conversation remains inaccessible to unauthorized third parties while it is being transmitted. This is the foundation of secure communication, but it protects only the message itself.
The second layer is metadata handling. Every communication system generates operational information required to deliver messages. The amount of metadata collected, processed, and retained varies between platforms, making metadata protection an essential part of any privacy assessment.
The third layer is infrastructure and service architecture. Communication depends on authentication systems, message routing, notifications, cloud services, backups, and other supporting infrastructure. The way these components are designed and managed has a direct impact on the overall privacy experienced by users.
The fourth layer is user control and transparency. A privacy-focused platform should provide users with clear information about what data is collected, why it is processed, how long it is retained, and what controls users have over their own information. Transparency and user control are fundamental principles of trustworthy system design.
Encryption remains one of the strongest security technologies available today, but it should not be mistaken for complete privacy. True privacy is achieved only when message protection, metadata management, infrastructure design, and user control work together as parts of a comprehensive security model.
VI. How Server-Side Data Shapes the Privacy Model
Many users assume that end-to-end encryption means only the sender and recipient are involved in every aspect of communication. In reality, modern messaging platforms—including WhatsApp, Telegram, Signal, and others—still rely on server-side infrastructure to authenticate users, route messages, synchronize devices, deliver notifications, and operate their services. Features such as contact discovery, account management, optional cloud services, and optional location sharing also depend on server-side systems to coordinate communication between users. As a result, platforms process operational information beyond the encrypted message itself. Depending on the platform's architecture, this may include account details, device information, connection records, timestamps, routing information, and other forms of metadata that support service operation, reliability, spam prevention, fraud detection, and performance monitoring. While end-to-end encryption protects message content, the surrounding communication ecosystem continues to play a significant role in how user data is handled and how privacy is ultimately experienced.
VII. If the Service Is Free, What Pays for the Infrastructure?
Free messaging platforms often create the impression that private communication comes at no financial cost to the user. In reality, operating a global communication service requires significant resources, including data centers, servers, network bandwidth, cloud infrastructure, security operations, software development, and continuous maintenance. Every message delivered, every account authenticated, and every notification sent depends on infrastructure that must be funded.
For this reason, every platform operates under a business model. Some rely on subscriptions, some on enterprise services, some on advertising, and others on investor funding or a combination of these approaches. In certain cases, user data, analytics, or aggregated usage insights may also contribute to advertising, product improvement, market research, or business decision-making, depending on the platform's policies and practices.
This is why understanding how a platform funds its infrastructure is just as important as understanding its encryption model. Privacy is influenced not only by how messages are protected, but also by how user information is collected, processed, retained, and used within the platform's overall business and operational ecosystem.
VII. If the Service Is Free, What Pays for the Infrastructure?
Free messaging platforms often create the impression that private communication comes at no financial cost to the user. Many users assume that because they are not paying for the service, there is nothing else to consider. In reality, operating a global communication platform requires enormous investment in data centers, servers, cloud infrastructure, network bandwidth, security operations, software engineering, and continuous maintenance. Every message delivered, every account authenticated, every notification sent, and every server request consumes infrastructure that must ultimately be funded.
For this reason, every platform operates under a business model. Some rely on subscriptions, some on enterprise services, some on advertising, and others on investor funding or a combination of these approaches. Depending on the platform's policies and architecture, operational data, analytics, and aggregated usage information may also be used to improve products, measure user behavior, support market research, personalize services or advertising, and guide future business decisions. The extent to which this occurs differs between platforms.
For users, this raises an important question: if a service appears to be free, what is actually funding the infrastructure behind it? Understanding a platform's business model is just as important as understanding its encryption model. Privacy is influenced not only by how messages are protected, but also by what information is collected outside the encrypted message, how it is processed, how long it is retained, and how transparently the platform explains these practices. These factors play a central role in determining the level of privacy users actually experience.
Sources
Geopolitical Analysis & Digital Sovereignty
Mathilde Pannier (IFRI) — Software Power: The Economic and Geopolitical Implications of Open Source Software
https://www.ifri.org/en/studies/software-power-economic-and-geopolitical-implications-open-source-software
Chatham House — Trump's AI Action Plan seeks customers, not partners
https://www.chathamhouse.org/2025/07/trumps-ai-action-plan-seeks-customers-not-partners
Real Instituto Elcano — Can open source secure Europe's digital infrastructure?
https://www.realinstitutoelcano.org/en/analyses/can-open-source-secure-europes-digital-infrastructure/
Geopolitical Monitor — Distributed Risk: Open-Source Software as Strategic Infrastructure
https://www.geopoliticalmonitor.com/distributed-risk-open-source-software-as-strategic-infrastructure/
CSIS — Government Open Source Software Policies
https://www.csis.org/programs/strategic-technologies-program/resources/government-open-source-software-policies
Open Source Governance, Sanctions & Dependency
Software Freedom Conservancy — Linux banned Russian contributors. Does my FOSS project need to worry about U.S. sanctions?
https://sfconservancy.org/blog/2024/dec/12/linux-banned-russian-contributors-do-i-need-to/
Hackread — Linux Kernel Project Drops Russian Developers Amid US Sanctions Concerns
https://hackread.com/linux-kernel-project-drops-russian-developers-sanction/
TechCrunch — GitHub confirms it has blocked developers in Iran, Syria and Crimea
https://techcrunch.com/2019/07/29/github-ban-sanctioned-countries/
Felipe Contreras — The Linux Foundation is wrong about sanctions
https://felipec.wordpress.com/2024/10/26/linux-foundation-sanctions/
Corporate Influence in Open Source
The New Stack — Who Contributes to the Linux Kernel?
https://thenewstack.io/contributes-linux-kernel/
The Register — Who writes Linux and open source software?
https://www.theregister.com/2023/02/24/who_writes_open_source/
Linux Foundation — Linux Kernel Development Reports
https://www.linuxfoundation.org/
Software Supply Chain Security
Andres Freund — Initial disclosure of the XZ Utils backdoor
https://www.openwall.com/lists/oss-security/2024/03/29/4
CISA — CVE-2024-3094 XZ Utils Supply Chain Compromise Alert
https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-compromise-affecting-xz-utils-data-compression-library-cve-2024-3094
Wiz Research — IngressNightmare in Kubernetes
https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities
Kubernetes Blog — Ingress-nginx CVE-2025-1974
https://kubernetes.io/blog/2025/03/24/ingress-nginx-cve-2025-1974/
Kubernetes Blog — Ingress NGINX Retirement Announcement
https://kubernetes.io/blog/2025/11/11/ingress-nginx-retirement/
China and Alternative Digital Ecosystems
Jamestown Foundation — Open-Source Technology and PRC National Strategy
https://jamestown.org/program/open-source-technology-and-prc-national-strategy-part-i/
Rest of World — China wants to build an open-source ecosystem to rival GitHub
https://restofworld.org/2021/china-gitee-to-rival-github/
European Commission — Open Source Software Country Intelligence Report: China
https://interoperable-europe.ec.europa.eu/sites/default/files/inline-files/OSS%20Country%20Intelligence%20Report%20China.pdf
A Different Approach to Privacy-Focused Communication
Traditional messaging systems often require centralized server-side infrastructure to authenticate users, route communication, synchronize devices, and provide additional services. This architecture can create operational data that must be processed and managed by the service provider.
VeilComm was created around a different privacy approach: reducing unnecessary server-side data exposure by minimizing what information needs to be collected, stored, or retained. The objective is not only to protect message content through encryption, but also to rethink how communication systems handle metadata and operational information.
Instead of building privacy around a single security layer, the approach focuses on limiting unnecessary data collection and reducing the amount of information that exists outside the user's control. By minimizing server-side data dependency, privacy risks associated with large-scale data storage, profiling, and unnecessary retention can be reduced.
The goal is simple: a communication system should not require excessive access to user information in order to provide secure communication.
Top comments (0)