Secure collaboration without boundaries

Matrix is an open standard for real-time communication over the internet. It has features which are suitable for communication in a healthcare setting where privacy and control over data are important. This introduction is a good start for some background on Matrix.

We believe that Matrix will become an important part people's online presence similar to how most people have an email address as their fundamental identity and communication channel when online. However, rather than being made for "letter" sending and receiving paradigm, Matrix is built for real-time, private, decentralised communication.

One important feature of the Matrix ecosystem is that it is a standard. There are multiple ways you can connect to the Matrix network. This can be a bit confusing at first but ultimately puts more control in your hands. There are several "clients" (these are the apps that let you connect to Matrix) available and more under development. There are also several "servers" (these are the things that host your chats) available and even more in development. There is even a roadmap for a future of Peer to Peer Server/Clients that run entirely in the web browser, so you can fully own and control your own data.

Element is the name of a popular Matrix client. It was previously known as Riot. This is an open-source application available for Android, iOS, Windows, MacOS and Linux.

Element is also the name of a business that funds the development of the Element App, and provides Element Matrix Services which is private hosting for Matrix for teams and enterprise.

If you are an organisation or team looking to adopt Matrix as your chat platform we highly recommend that you use Element Matrix Services. Their offering is tailored for this use case and support things like custom domain names.

The use case for Traversity is a bit different. Our aim is to help organisations cross boundaries, so standard per-seat licensing just doesn't work. This is why we have Guest Passes, so that the people using Traversity can collaborate with people who do not have licenses.

The great thing about Matrix is that if an organisation does use Element Matrix Services, or sets up their own Matrix compatible server, it is fully interoperable with Traversity. In this case, these users do not require Traversity licenses or guest passes. This would also be true for P2P users.

A Guest Pass is a way to grant someone access to Secure Chat. This can be for any time period you wish, although each Traversity subscription has a limited number of Guest Passes.

Guest Pass invitations are sent via email to your nominated recipients who are then able to create their Traversity account and access the Secure Chat.

When Guest Passes are revoked, the user is signed out of the Secure Chat service and unable to login again. Their data, profile and settings are retained so that if a Guest Pass is given back to that person they are able to login again and not have to set everything up again.

In most cases, the connection between the client (you) and the server (WhatsApp, Telegram, etc.) is encrypted. However, there is no guarantee that the operators of the server are not accessing the contents of the communication. This is why security and privacy advocates recommend the use of clients that support some form of End-to-end-encryption (E2EE). This is where the communication between parties to a conversation are encrypted in a way that only the participants can decrypt.

One of the challenges implementing E2EE is the key exchange. In order for each party to encrypt their data they need to exchange a secret that is only known to themselves. When you add in the fact that to be secure this secret needs to be something like a strong password it becomes cumbersome for user experience and software developers to implement. Nobody wants to type in a long password just to open up a message. The problem becomes compounded if you use multiple devices as most people do these days.

There are differing approaches and therefore compromises made in solving this problem. In the case of WhatsApp, Telegram, Signal and a few others, their compromise is to facilitate the key exchange on the users behalf through a centralised server. This option offers the ability to seamlessly use multiple devices, retrieve chats from lost devices, search through chat history and other features. The compromise is that you must trust that the operators of these centralised services are not going to access your secure keys.

However, it should be noted that many of these services offer direct or single-device chats which are not vulnerable to key theft as the keys never leave the devices. These platforms (namely Wire, Signal and Telegram) have all undergone 3rd party audits to prove the security protocols used in their apps. If your use case involves information which requires the highest levels of information protection then we recommend you use one of those applications.

Where Matrix and therefore Traversity is different is that to enable E2EE, Matrix requires clients to undergo a direct key exchange. This can be done by scanning an QR code, or through a visual confirmation. This key is then used to encrypt a package of keys which can then be used on a centralised key exchange to facilitate multi-device connection, retrieving lost chats and search. However there is also one other important distinction - we are the operators of the server. We are bound by all relevant Australian legislation and by our own internal information and security policies which minimise access to the server which host the chat.

Matrix supports a number of bridges to alternative chat and communication services. These are generally for advanced users as they require you to be comfortable typing commands via the chat input window.

We have rolled out support for WhatsApp and can support Slack, Telegram, FB Messenger, Twitter, Discord and Hangouts should users wish to use these services. Check out the video below for a simple demo: