GLYPH BY SENTRIQS

SECURITY FAQ

Straight answers on how Glyph protects sensitive, high-consequence communications. Jump to a topic or expand any question.

Encryption Keys & Access Threat Model Devices & Boundaries Records & Oversight Deployment Standards

Encryption and Cryptographic Design

06 QUESTIONS

Can Glyph read the content of our communications?

No. Glyph encrypts messages, files, calls, meetings, and video end to end before they leave the sender’s device. Because it does not have access to customer keys, the platform only sees ciphertext.

Does every message carry a digital signature?

Yes. Recipients can verify that the content was not altered in transit and that it came from the specific authorized device the signature identifies. Forged or modified messages are detectable at the protocol level, not left to user judgment.

What protects past and future messages if a key is compromised?

MLS provides forward secrecy and post-compromise security. A compromised key does not expose earlier messages, and fresh keys are established so later messages remain protected. A compromise is contained to the affected device because each participates independently in the key structure.

How does Glyph scale post-quantum cryptography without performance degradation?

Glyph uses the MLS ratchet tree so key rotation scales logarithmically rather than linearly, which makes post-quantum key management viable at enterprise scale.

How are archived records protected from future quantum attacks?

Stored records are protected by post-quantum cryptographic keys, which reduces exposure to "harvest now, decrypt later" attacks. The archive key is generated when archiving is turned on, and the administrator holds it locally under the organization's own security practices. Records retained today stay protected for as long as they matter.

How does Glyph stay current as cryptographic standards evolve?

Crypto-agility is a design property, not a future roadmap item. Cryptographic components are modular, which means algorithms can be swapped without platform replacement or service interruption. As NIST and other standards bodies finalize additional algorithms, Glyph is built to absorb them. The transition happens without platform replacement.

Keys, Access, and Administrative Control

04 QUESTIONS

Who holds the encryption keys for our communications?

The customer does. Device-level keys live inside the MLS ratchet tree on each authorized endpoint. Administrators control which devices enter which groups. For stored records, the post-quantum key is produced when an administrator turns on archiving, and your organization holds it locally. The platform has no access to these keys at any point in the communication lifecycle.

What authentication does Glyph require at login?

Glyph supports multiple types of multi-factor authentication for account access, including passkeys and one-time passwords, in line with zero-trust requirements. Credentials alone are never sufficient. The combination of biometric MFA at login and device-level authorization into each group means attackers cannot reach sensitive content by compromising a password.

What controls exist for personal devices?

Administrators set device access at the channel level. Sensitive groups can be restricted to organization-issued hardware, while other spaces can permit personal devices. Because each endpoint is independently authorized into each group, a compromised personal device exposes only the communications it was allowed to reach, not the full platform.

Does Glyph notify you when access or membership changes?

Yes. Users receive real-time alerts when a device joins or leaves a group. Users can see which of their own endpoints are active and flag anything that is not theirs.

Threat Model and Security Operations

03 QUESTIONS

How does Glyph defend against AI-generated phishing and social engineering?

AI is making phishing, impersonation, and social engineering more convincing and easier to scale. Glyph shrinks the threat surface at the architecture level. Administrators invite participants. Self-onboarding does not exist. Accounts that are not already members of a workspace cannot be selected as recipients, so a spoofed identity, deepfake, or malicious outsider cannot reach users inside the platform as a delivery path for phishing or social engineering.

What happens if a user's credentials are stolen?

Credentials alone do not open sensitive channels in Glyph. Each device is independently authorized into each group through the MLS protocol, so a stolen password does not carry a new endpoint into existing conversations. An unfamiliar device attempting to log in can be removed instantly. The architecture assumes credential theft and makes it insufficient for compromise.

Can a user accidentally add the wrong person to a sensitive channel?

No. Only administrators can add participants to a group, and only existing workspace members appear as selectable options. A person who was never admitted to the workspace cannot be reached by an inadvertent invitation or mistyped address. This is architectural, not a training control.

Devices, External Parties, and Workspace Boundaries

03 QUESTIONS

What devices and operating systems does Glyph run on?

Web, iOS, and Android.

How does Glyph handle outside counsel, partner agencies, and third-party guests?

External participants enter specific workspaces or channels with access scoped to only what they need to see. They cannot browse other conversations, direct-message outside their designated groups, or discover the broader directory. For coalitions or rapid response, administrators can onboard at scale using QR codes or time-limited invite links with predefined group assignments and start times.

Can guest access be time-limited or automatically removed?

Yes. Every invitation can carry a start time and expiration, so access ends on schedule without manual cleanup. Administrators can also revoke any user or device instantly.

Records, Retention, and Oversight

03 QUESTIONS

Can records be retained, searched, and produced for regulators?

Yes. When an administrator activates archiving, Glyph retains tamper-resistant records searchable by user, date, time, or keyword, and extractable for regulator or auditor review. Archiving is off by default and can be enabled in specific groups or account-wide. Retention supports compliance without creating a back door into live communications.

Can Glyph decrypt archived records?

No. When archiving is enabled, the administrator is presented with the post-quantum archive key and stores it locally. The platform does not hold or store that key.

Can encrypted channels and their contents be permanently destroyed?

Yes. Administrators can permanently destroy encryption keys and associated content at the channel level. Once executed, the content cannot be reconstructed. When engagements end or matters close, this gives the organization a defensible way to terminate both access and the underlying record, under its own policy.

Deployment, Environments, and Integration

02 QUESTIONS

What deployment environments does Glyph support?

Cloud, on-premises, and air-gapped. It can also be white-labeled under your organization’s branding.

Can Glyph's capabilities be embedded into our internal applications?

Yes, through GlyphKit. An SDK for iOS, Android, and the web lets developers incorporate Glyph's MLS and post-quantum cryptography into their own software.

Standards, Certifications, and Verifiability

03 QUESTIONS

What cryptographic standards does Glyph meet?

Glyph aligns with FIPS 203 (ML-KEM) for post-quantum key encapsulation, FIPS 204 (ML-DSA) for digital signatures, IETF RFC 9420 for Messaging Layer Security, and NIST IR 8547 for post-quantum migration guidance. Glyph meets the 2026 CISA procurement criteria for quantum-safe collaboration software.

Has Glyph been independently evaluated by third parties?

Yes. Glyph is the only platform in NowSecure's secure messaging benchmark group to achieve a perfect mobile application security score. It has also passed third-party penetration tests. Glyph has been formally reviewed and recommended by Jones Group International, led by General James L. Jones (Ret.), for deployment in contested, regulated, and mission-critical environments.

Which regulatory frameworks does Glyph support?

Glyph supports regulatory obligations across high consequence sectors: SEC Rules 204-2 and 17a-4 and FINRA Rule 4511 for books-and-records retention, DORA for ICT risk management in EU financial entities, NERC CIP for critical infrastructure communications security, and NIS2 for EU risk oversight across energy, finance, health, and digital sectors.