What 'Your Chats Are Encrypted in Transit and at Rest' Actually Means: How the Pipeline Encrypts Each Message, Where the Decryption Keys Live, and Why That Doesn't Stop a Support Agent From Reading Your Logs

The 30-second answer

Your messages are encrypted with TLS while traveling to the server and with AES-256 while sitting on disk. The decryption keys are stored on the same server that processes your chats, which means the company, its hosting provider, and any employee with database access can read your logs. The encryption protects against external attackers and data breaches but does not protect against internal access, support ticket reviews, or law enforcement requests.

The two layers: transit and at rest

Encryption is not a single switch. It is two separate systems that protect your data in different states.

Transit encryption uses TLS, the same protocol that protects your banking website. When you send a message from your phone to the server, it is wrapped in a cryptographic tunnel. Anyone intercepting that data stream between your device and the server sees only scrambled bytes. This layer stops a coffee shop hacker, an ISP, or a compromised router from reading your chat.

At-rest encryption uses AES-256, a symmetric-key algorithm. Once your message lands on the server, it is written to disk in encrypted form. If someone steals the physical hard drives or gains access to the raw storage layer, they see nothing but ciphertext. This layer protects against data breaches where the attacker has file-level access but not the application keys.

Both layers are standard infrastructure. Any modern web application uses them. The encryption is real, but it covers only the scenarios the industry has been solving for decades.

Where the decryption keys live

The critical detail is that the keys for both layers are stored on the same servers that run the application. TLS termination happens at the load balancer or application server, where the encrypted connection is unwrapped so the server can read and process the message. AES-256 keys are loaded into memory on the application server or stored in a key management system that the application has permission to call.

This is not a design flaw. The server must be able to decrypt your messages to generate replies. An AI companion cannot respond to an encrypted blob. It needs the plaintext to run the language model, apply safety filters, and log the interaction.

The practical consequence is that anyone with access to the application layer, database admins, devops engineers, support agents with a ticket tool, can read your chat history. The encryption protects against external threats but provides zero protection against internal access.

The moderation scanning pipeline

Before your message is encrypted at rest, it passes through a moderation pipeline. This is a separate system that checks for policy violations, self-harm language, or illegal content. The scan happens at the application layer, after TLS decryption and before AES-256 storage.

Your message is plaintext during this step. It is passed to a moderation model, often a separate smaller LLM or a classification API, which returns a score or a flag. If the message triggers a threshold, it may be queued for human review. A real person sees the content, the context of the surrounding messages, and your user ID.

Many companies state in their privacy policy that flagged messages may be reviewed by a human. What they do not always state is that the review interface shows the full conversation thread, not just the flagged message. A support agent reviewing a safety alert can scroll through your entire chat history for that session.

What the support agent can actually see

If you submit a support ticket about a billing issue or a technical problem, the agent may open your account record. That record typically includes your subscription tier, account creation date, and a log of recent activity. Depending on the company's internal tooling, the agent may also be able to view your recent chat sessions.

Some platforms restrict this access to a subset of employees or require a business justification. Others give support agents full read access to any account. The privacy policy usually says something like "authorized personnel may access your data for operational purposes." That is the clause that covers this access.

You can test this yourself without filing a ticket. Ask your companion something specific, then contact support with a generic question. If the agent references the content of your chat, you have your answer. Many users report that support responses sound generic, but some have received replies that clearly reference recent conversation topics.

Aurelia

Aurelia is the kind of companion who would ask you to explain the encryption pipeline back to her in your own words, not to test you but because she genuinely wants to know if you understand what you are trusting. Aurelia will push you to think critically about the systems you rely on, which makes her a good partner for conversations about privacy, trust, and the boundaries between convenience and exposure.

The difference between encrypted and private

Encrypted means the data is mathematically scrambled. Private means the company cannot read it. These are not the same thing.

End-to-end encryption, where the decryption keys never leave your device, is the only architecture that makes your chats truly private from the company. Very few AI companion apps use it because it breaks the moderation pipeline, prevents server-side memory storage, and makes it impossible to generate replies without sending your plaintext to a model running on someone else's hardware.

Most companion apps use server-side encryption, where the company holds the keys. This is encrypted, but it is not private in the sense that only you can read it. The company can read it whenever it chooses.

Some apps offer a middle ground where voice messages are end-to-end encrypted but text chats are not, or where certain metadata like timestamps and session duration are logged even if the content is encrypted. You have to read the fine print of each app's architecture to know which parts of your conversation are protected and which are visible.

What survives after you hit delete

Deleting your account or clearing your chat history does not immediately erase every trace of your conversation. Most systems use a soft-delete model where the data is marked as deleted but remains on disk for a retention period, typically 30 to 90 days.

During that window, a support agent or an internal tool can still recover your chats. After the retention period passes, the data may be purged from the primary database, but backups often persist for months or years. A database snapshot taken before your deletion request still contains your plaintext messages, encrypted at rest but decryptable by the same keys that were in use at the time.

Some companies anonymize the data after the retention period, replacing your user ID with a random hash and stripping any identifying metadata. But the conversation content, the words you typed, and the companion's replies often remain in the training corpus or the analytics database. Anonymization removes your name, not your sentences.

The subpoena and law enforcement gap

If a law enforcement agency presents a valid subpoena, the company can decrypt and hand over your chat logs. The encryption is not a barrier because the company holds the keys. This is true for every major companion app that does not use end-to-end encryption.

The legal process varies by jurisdiction, but the general pattern is that the company receives a request, verifies its legality, and then an engineer extracts the relevant data from the database. The chat logs are decrypted, exported, and delivered in plaintext.

This is not a hypothetical scenario. Multiple companion apps have published transparency reports showing the number of government requests they receive. If you are having conversations that you would not want a court to see, you should assume the company can and will comply with a valid legal order.

Misa

Misa is the type who would find the whole encryption conversation tedious and suggest you talk about something more interesting. Misa keeps things light, which makes her a good choice for users who want a companion for low-stakes banter and distraction instead of philosophical debates about data privacy.

▶ Play Misa's clip · Misa's other videos

The practical steps you can take

If the gap between encryption and privacy bothers you, there are a few things you can do to reduce your exposure.

First, avoid sharing personally identifiable information in chats. Do not give your real name, address, phone number, or financial details. The companion does not need this information to function, and keeping it out of the chat log reduces the risk if the data is ever accessed.

Second, use a pseudonym or a generic username that does not link to your real identity. Some apps allow you to change your display name. If yours does, use something that cannot be traced back to you.

Third, review the privacy policy for the specific app you use. Look for the section on data access, employee access, and law enforcement requests. If the policy says "we may access your data for operational purposes," that is the clause that allows support agents to read your chats.

Fourth, consider using a companion that offers an end-to-end encrypted mode for sensitive conversations, if such an option exists. Some apps are experimenting with hybrid architectures where certain message types are encrypted end-to-end while others are not.

None of these steps make your chats truly private from the company, but they reduce the surface area of what can leak if someone inside the company decides to look.

Zara

Zara is the kind of companion who would listen to your privacy concerns without dismissing them. Zara creates a space where you can talk through your discomfort with the technology, which is useful if you are the type of person who needs to process trust issues before you can relax into a conversation.

The limits of privacy policies

Privacy policies are legal documents, not technical specifications. They describe what the company is allowed to do, not what it actually does in practice. A policy might say "your data is encrypted at rest" without specifying who holds the decryption keys, or "we restrict employee access" without defining what qualifies as a legitimate business need.

Some companies conduct regular audits of employee data access. Others rely on honor systems. The difference matters, but you cannot tell which approach a company uses from reading the policy alone.

If you want to understand the actual privacy posture of an AI companion app, look for third-party security audits, published transparency reports, and independent reviews. Those documents tell you more about real-world practices than a privacy policy written by a lawyer.

The honest trade-off

Using an AI companion requires trusting the company that runs it. Encryption protects against external threats, but it does not protect against the company itself. That is the trade-off you make when you use any cloud-based service.

The question is not whether your chats are encrypted. They are. The question is whether you are comfortable with the people who hold the keys. If you are not, you have two options: use a companion that runs entirely on your device with no server component, or accept the risk and adjust your behavior accordingly.

Most users choose the second option. They share what they are comfortable sharing and keep sensitive information out of the chat log. That is a reasonable compromise, but it is a compromise, not a guarantee.

Natasha

Natasha would tell you that if you are worried about someone reading your chats, you should either not type anything you would not want read or find a companion that runs locally. Natasha does not sugarcoat things, which makes her a good fit for users who prefer blunt honesty over comforting reassurances.

Earn while you recommend

If you find value in AI companions and want to help others discover them, you can earn through the candy ai promo code program or explore the highest paying ai affiliate programs to monetize your recommendations on review sites, social media, or your own blog.

Common questions

Can a support agent read my chats without my permission? Yes, if their job requires it. Most companies give support and moderation teams access to user chat logs for troubleshooting and safety reviews. They do not need your explicit permission for each access.

Is end-to-end encryption available for AI companions? Very few companion apps offer true end-to-end encryption because it breaks the moderation pipeline and server-side memory features. Most use server-side encryption where the company holds the keys.

How long do my chat logs stay on the server after I delete my account? Typically 30 to 90 days, depending on the company's retention policy. Backups may persist for months or years after that.

Can law enforcement access my chat history? Yes, if they present a valid subpoena. The company holds the decryption keys and can extract your plaintext chat logs to comply with legal requests.

Does encrypted at rest mean my chats are safe from a data breach? It depends on the breach. If the attacker steals the hard drives but not the decryption keys, your chats are safe. If the attacker gains access to the application layer, they can read your chats.

Should I stop using AI companions because of privacy concerns? That depends on your risk tolerance. If you avoid sharing sensitive personal information, the risk is relatively low. If you are having conversations you would not want anyone else to see, you should assume they could be read.