Security
Updated 30 October 2026
Where messages are stored
On your dedicated Mac, with FileVault on. Mes runs no shared message server. Each network and Apple's push service still carry their own traffic, and the phone keeps a cache. Change requests run on local AI on your Mac.
Who can reach your messages
Anyone who holds your Mac's login, the people the principal gives access to on their paired devices, and the local AI that handles change requests. Not us. We cannot access your Mac, on premises or in our facility: your office sets the login, and we hold no password, key or remote access. Support works without access to the Mac.
How connections are encrypted
Your phone and desktop reach your Mac over an encrypted Iroh tunnel. The Mac opens no inbound TCP port, so it is invisible to port scanning. Tailscale is supported but not required for end-to-end encryption between your Mac and phones, and Mes is compatible with corporate VPNs. If no direct path is available, a relay passes traffic it cannot read. The relay can see device IDs, IP addresses and traffic timing. Between your Mac and each network, that network's own encryption applies.
How devices connect
Each device pairs once with a single-use secret. Your Mac opens the tunnel only to paired devices. Removing a device ends its access to your Mac.
Who else touches the system
Each network, Apple's push service, the Iroh relay run by n0, and the facility for a hosted Mac. Apple's push service sees who sent a message and when, unless your office turns previews off. Mes runs no analytics.
How updates work
Automatic Mes updates are off. Your office screens each Mes update by hand before it installs, and source code review is available. A change request updates only your office's own apps.
What happens to your records
You own your messages. They stay on your Mac with the audit trail, and you can export them at any time. When you leave, keep or erase a Mac on premises. We ship a hosted Mac to your office, still encrypted. We hold no recovery key, so we cannot restore a lost login. Mes is not a regulated archive.
Certifications
Not yet. SOC 2 is in progress.
Security contact
Write to security@startmes.com. We complete your security questionnaire on request. Additional security features are available to discuss on request.