Security that runs silently.

80+ features protecting every message — none of them ask for your attention.
What's running silently

Eight layers of protection. None of them ask for your attention.

Most security is theatre — warnings, banners, confirmation dialogs. White Dot's security is invisible by design. Select a category to see what's running beneath the surface.

Communication

10 features

Account

10 features

API & Backend

10 features

Chat

10 features

Device

10 features

Privacy

10 features

Infrastructure

10 features

Advanced AI

10 features

Communication security

Every byte that leaves your device is encrypted before it hits the network — and only your recipient can decrypt it. Not us, not anyone.

  • ✓ End-to-End Encryption (E2EE) — messages encrypted on your device, readable only by the intended recipient.
  • ✓ Perfect Forward Secrecy — past sessions stay safe even if keys are ever compromised.
  • ✓ Device-Bound Keys — keys live in secure hardware, never on our servers.
End-to-End Encryption (E2EE)Messages are encrypted on your device and can only be read by the intended recipient.
Perfect Forward SecrecyEncryption keys rotate continuously; a compromised key never exposes past messages.
Session Key RotationKeys rotate continuously throughout a conversation for maximum resilience.
Device-Specific Encryption KeysEach device holds unique keys. One device lost never means all conversations exposed.
Encrypted Media UploadsPhotos and files are encrypted before they leave your device.
Encrypted BackupsBackups are encrypted with keys only you control.
Encrypted Local DatabaseThe on-device message store is encrypted at rest.
Encrypted Push NotificationsNotification previews are never sent in plaintext.
Message Integrity VerificationTampering with any message is detected immediately.
Anti-Tampering SignaturesEvery message carries a cryptographic signature.

Account security

Your account is bound to your device and behaviour — not just a password. Anomalies are caught before they become breaches.

  • ✓ Device Binding — your account is tied to your trusted hardware.
  • ✓ Login Risk Detection — suspicious sign-ins are blocked automatically.
  • ✓ New Device Alerts — you're notified the moment a new device connects.
Device BindingYour account is tied to your trusted hardware, not a password alone.
Trusted Device ManagementManage and revoke every device from one place.
Multi-Factor AuthenticationBiometric MFA is required for sensitive actions.
Login Risk DetectionAnomalous sign-in behaviour is flagged in real time.
New Device AlertsInstant notification when a new device authenticates.
Session FingerprintingEvery session carries a unique behavioural fingerprint.
Automatic Session RevocationStale or risky sessions are terminated automatically.
Suspicious Login DetectionImpossible travel and unusual IPs trigger lockdown.
SIM Swap DetectionProtects against SIM-swap takeover attacks.
OTP Abuse ProtectionOne-time codes are rate-limited and device-bound.

API & backend security

Every request your app makes is signed, validated, and replay-resistant. Attackers probing the API surface get nothing usable.

  • ✓ Request Signing — every API call is cryptographically signed.
  • ✓ Replay Protection — captured requests can never be replayed.
  • ✓ IP Reputation Checks — known-bad sources are blocked.
Request SigningEvery API call is cryptographically signed by the device.
JWT RotationTokens are short-lived and continuously rotated.
Refresh Token RotationStolen refresh tokens become unusable.
Replay Attack ProtectionNonces make every request unique and unforgeable.
Rate LimitingBrute-force attempts are throttled automatically.
IP Reputation ChecksRequests from known-bad sources are dropped.
Device Fingerprint ValidationAPI access requires a verified device identity.
API Abuse DetectionAbusive request patterns are detected and blocked.
Request Tampering DetectionModified payloads are rejected at the edge.
Geo-Velocity ChecksImpossible travel between requests triggers alerts.

Chat protection

The conversation layer carries its own defences — against screenshots, forwarding, unwanted retention, and the metadata that follows messages around.

  • ✓ Screenshot Detection — capture attempts are detected.
  • ✓ Self-Destruct Timers — messages vanish when you want.
  • ✓ View-Once Media — photos that can only be seen once.
Screenshot DetectionCapture attempts are detected and blocked.
Screen Recording DetectionRecording attempts trigger protective action.
View Once MediaPhotos and videos that can only be seen once.
Self-Destruct MessagesMessages auto-delete after a set timer.
Message Recall for EveryoneRecall messages from every participant.
Anti-Forwarding ControlsLimit how far your messages can travel.
Sensitive Content BlurPreview blurs before you choose to view.
Hidden Metadata ProtectionTimestamps and read states stay private.
Link ScanningMalicious links are flagged before you tap.
Malware Attachment DetectionDangerous files are caught on arrival.

Device security

White Dot verifies the integrity of your device before trusting it with your messages. Compromised environments are detected and blocked silently.

  • ✓ Root / Jailbreak Detection — compromised devices are locked down.
  • ✓ Hardware Key Storage — keys live in the Secure Enclave.
  • ✓ App Integrity Check — tampered builds are refused.
Root / Jailbreak DetectionRooted or jailbroken devices are detected and locked down.
Emulator DetectionThe app refuses to run in automated emulator environments.
Hooking Framework DetectionRuntime hooking tools are detected before interception.
Frida DetectionFrida-based instrumentation is detected and blocked.
Magisk DetectionSystemless root via Magisk is detected.
Debugger DetectionActive debuggers halt sensitive operations.
Screen Overlay DetectionOverlay attacks are detected and blocked.
Clipboard ProtectionSensitive clipboard content is cleared automatically.
Secure Storage (Keychain / Keystore)Keys live in hardware-backed secure storage.
App Integrity VerificationThe binary hash is verified at every launch.

Privacy features

You control exactly what others can see about you — and the default is nothing. Visibility is always opt-in, never opt-out.

  • ✓ Hidden Phone Number — your number stays yours.
  • ✓ No Last-Seen Tracking — online status is private.
  • ✓ IP Address Masking — your location is never exposed.
Privacy-Preserving Contact DiscoveryContacts sync without exposing your address book.
Hidden Phone Number ModeYour phone number is never shared by default.
Hidden Last SeenLast-seen timestamps are invisible by default.
Hidden Online StatusPresence is private unless you opt in.
Hidden Read ReceiptsRead states are yours to control.
Hidden Profile PictureYour photo shows only to contacts you choose.
Anonymous User IDsInternal identifiers reveal nothing about you.
Metadata MinimisationThe smallest possible footprint is collected.
Private Relay for Media URLsMedia links never expose your IP address.
IP Address MaskingYour location stays hidden from recipients.

Infrastructure security

The systems that carry your messages are hardened at every layer — from the network edge to the database, and everywhere between.

  • ✓ WAF + DDoS Protection — attacks die at the edge.
  • ✓ Encrypted at Rest — storage is block-level encrypted.
  • ✓ Audit Logging — every system event is recorded.
DDoS ProtectionDistributed attacks are absorbed at the network edge.
Web Application FirewallMalicious web traffic is filtered automatically.
Intrusion DetectionAnomalous activity is flagged in real time.
Real-Time Threat MonitoringSecurity events are watched around the clock.
Automated Secret RotationCredentials rotate automatically, never reused.
Database Encryption at RestStored data is encrypted at the block level.
Encrypted Object StorageFiles live in encrypted object stores.
Secure Audit LoggingTamper-evident logs for every system event.
Security Event CorrelationSignals are correlated across systems.
Zero Trust Service CommunicationServices verify each other on every call.

Advanced & AI security

The frontier layer — AI-driven anomaly detection, hardware cryptography, and architecture built to remain secure as threats evolve over the next decade.

  • ✓ AI Spam Detection — junk never reaches you.
  • ✓ Quantum-Ready Keys — built for tomorrow's threats.
  • ✓ Hardware-Backed Crypto — keys never leave secure silicon.
Device Trust ScoreEvery device carries a continuous trust rating.
Behavioural Anomaly DetectionUnusual usage patterns are detected by AI.
AI-Based Spam DetectionSpam is filtered before it reaches you.
AI-Based Scam DetectionSocial-engineering scams are flagged.
Account Takeover DetectionTakeover attempts are neutralised in real time.
Invisible Bot DetectionAutomated bots are identified and blocked.
Continuous Session ValidationSessions are re-verified throughout their life.
Secure Multi-Device SyncSync between devices stays end-to-end encrypted.
Quantum-Ready Key ArchitectureKey design resists future quantum attacks.
Hardware-Backed Cryptographic KeysKeys are generated and stored in secure hardware.
Why trust White Dot

We cannot — and will not — read your messages.

These aren't features. They're principles. Built into our architecture, enforced by mathematics, verified by independent auditors.

🔒
Zero knowledge

Encryption keys never leave your device. We cannot decrypt your messages, even if compelled.

📱
On-device encryption

Everything is encrypted before it touches the network. Not a single raw message reaches our servers.

🔍
Independently audited

Third-party security firms review our cryptography and infrastructure. Reports are public.

📖
Open architecture

Protocol documentation and cryptographic specifications are publicly available. Technical details, no magic.