Encrypted channels & DMs
Every channel has its own AES-256-GCM key, wrapped for each member with ECDH. Safety numbers let two people check they're talking to each other — not to a swapped key.
~ encrypted team chat
Team chat the server can't read
Sidechannel is end-to-end encrypted chat for teams — channels, threads, DMs and voice — hosted, patched and monitored for you by SudoSecurity.
- E2EE in every channel
- Keys never leave your browser
- Managed by our engineers
- Open source soon
what your team sees
Rolling the new build to prod at 10 — shout if anything breaks.
👍 3🚀 1
On it. Watching the error dashboard.
what the server stores
~ features
Everything a team needs, nothing it can leak
The chat features people expect from the big platforms, built on top of encryption instead of next to it.
Threads, mentions, inbox
Reply in threads, @mention people, react, edit and search. An activity inbox gathers what needs you, with unread badges and desktop notifications.
Leaked-secret guard
API keys, tokens and private keys are caught in your browser before a message is encrypted and sent — so a pasted credential never lands in history.
Roles & moderation
Owner, admin and member ranks enforced in the database, custom roles, private channels, AutoMod, slow mode and timeouts — nobody can manage someone who outranks them.
Integrations
GitHub events and incoming webhooks post straight into channels — encrypted on arrival — plus a Ghost publishing feed and staff sign-in for Ghost-powered teams.
Voice & phones
Drop-in voice channels over WebRTC, and a layout built for phones first: the channel list stays in reach at every screen size.
~ encryption
How the encryption works
Encryption happens in your browser with the Web Crypto API. Our servers relay and store ciphertext — they never hold a key that opens it.
-
Your keys are made on your device
When you first sign in, your browser creates an ECDH P-256 key pair. Only the public half is uploaded.
-
Each channel gets its own key
A random AES-256-GCM key per channel is wrapped separately for every member's public key. Leaving a channel means you stop receiving new keys.
-
Messages are sealed before they leave
Text is encrypted with a fresh IV per message; the server stores the ciphertext and delivers it in real time. Search and AutoMod run on your device, after decryption.
What we can still see: who is in which channel, and when messages are sent. That metadata is what lets us deliver messages and notifications — the content stays sealed.
~ managed
We run it. You talk.
Sidechannel is a managed service from the SudoSecurity team — the same people who run our own infrastructure.
HostedYour own workspace, provisioned and configured by our engineers.
PatchedUpdates and security fixes roll out without you lifting a finger.
Backed upEncrypted history is backed up — it stays encrypted in the backup too.
MonitoredHealth checks and alerts, watched by people, not just dashboards.
~ faq
Questions
What is Sidechannel?
Sidechannel is SudoSecurity's end-to-end encrypted team chat: channels, threads, direct messages and voice, with roles, moderation and integrations. We host and maintain it for you.
Can SudoSecurity read our messages?
No. Message content is encrypted in each member's browser and the keys are wrapped to members' own public keys. Our servers store ciphertext and metadata such as channel membership and timestamps.
Is Sidechannel open source?
Not yet — we plan to publish the source in the near future. Until then, Sidechannel is available as a managed service.
How do we get a workspace?
Open a ticket from the SudoSecurity client area and tell us about your team. We'll set up the workspace and walk you through inviting people.
Does it work on phones?
Yes. Sidechannel is designed mobile-first and works in any modern browser on phones, tablets and desktops.
Sidechannel is end-to-end encrypted team chat — channels, threads, DMs and voice — hosted, patched and monitored for you by SudoSecurity.
Move your team's conversations somewhere private
Tell us about your team and we'll have a Sidechannel workspace ready for you.