Use case

Privileged communication that no server, opposing party, or subpoena can quietly compel.

For attorneys protecting attorney-client privilege: end-to-end-encrypted, peer-to-peer messaging and file transfer where the network learns who you represent only if you let it — and where there is no central content store to subpoena.

The threat model

Opposing-party discovery and forensic e-discovery: a litigation adversary who subpoenas your communications, images a seized device, or seeks to compel production of client correspondence and the metadata around it.
Subpoena or court order served on the service provider: an adversary who skips you and goes to the app's operator to obtain message content, sender/recipient pairs, or IP logs — the exact data a central messaging server holds.
Metadata-driven inference of the client relationship: an investigator or journalist who cannot read the messages but maps that a named attorney is in frequent contact with a particular witness, target, or co-counsel — revealing strategy, a sealed representation, or a confidential source.
Network observers and traffic analysis: an ISP, courthouse or hotel Wi-Fi operator, or surveillance actor correlating when and how much you communicate with a client during a sensitive matter.
Insider or infrastructure compromise at the provider: an actor with root on the servers who can read whatever the operator can read.

Why mainstream apps fall short

Mainstream apps centralize the content trail you must protect. Standard messengers route through a server that knows Alice messaged Bob at 3:47 PM; even when content is encrypted, that server (and anyone who subpoenas it) can reconstruct a social graph linking an attorney to a client.
Discoverable metadata can pierce confidentiality even when content does not. The fact and pattern of a privileged contact — frequency, timing, message sizes hinting at document exchange — is itself sensitive and is exactly what most apps log and can be compelled to produce.
Consumer apps tie identity to a phone number or email, creating a directory that links your professional identity to every contact. That linkage is itself discoverable and undermines a confidential representation.
File exchange in mainstream tools leaves server copies and embedded metadata. Sending a draft pleading or evidence photo through a cloud chat stores a provider-side copy and ships EXIF/document metadata you did not intend to disclose.

How RVNT maps to those needs

Keep privileged message content unreadable to the network, the provider, and anyone who compromises the infrastructure

Hybrid post-quantum X3DH (X25519 + ML-KEM-768) key exchange feeding a Double Ratchet — content is encrypted end-to-end and the server never holds plaintext, keys, or a content store to subpoena

Prevent the metadata trail from revealing which client an attorney is communicating with

Sealed sender — the sender's identity is encrypted inside the envelope, so relays and observers see only a truncated recipient hash and an opaque blob, not who is talking to whom

Reduce what a subpoena to the provider can ever produce

Zero-knowledge / no-central-content architecture documented in the threat model: conversation history lives only on user devices, so a court order to RVNT cannot yield message content, sender/recipient pairs, or IP logs that were never collected

Exchange drafts, exhibits, and evidence without a server copy or leaked file metadata

Direct peer-to-peer file transfer with EXIF stripping and no plaintext on disk (no size limit on a direct connection; relay fallback is capped at 256 MB)

Defend privileged material if a device is seized or you are compelled at a border or in custody

Duress PIN that opens a decoy state plus panic-wipe cryptographic self-destruct, with local storage encrypted via SQLCipher (AES-256) and Argon2id PIN hardening

The legal & regulatory reality

The ABA's duty of technological competence (Model Rule 1.1, Comment 8) requires lawyers to understand the benefits and risks of relevant technology, and Model Rule 1.6(c) requires making reasonable efforts to prevent unauthorized disclosure of client information — a "reasonable efforts" standard that weighs the sensitivity of the data and the cost of safeguards. Tools like RVNT can be part of how a firm meets those obligations for especially sensitive communications. That is the full extent of the claim. RVNT is NOT certified, audited, or marketed as legally compliant with anything: it carries no SOC 2, no HIPAA capability, no Business Associate Agreement, and no e-discovery, legal-hold, or records-retention features (in fact its forward secrecy and device-only history work against retention obligations). It does not replace your firm's document-management, conflicts, or compliance systems, and using it does not by itself satisfy any bar rule. Whether a given tool is appropriate for a given matter is a professional judgment you must make — consult your jurisdiction's rules and your firm's information-governance and ethics counsel.

Where RVNT is the wrong tool

RVNT is pre-release software and has NOT undergone a formal third-party security audit. The threat model documents this directly. Do not rely on it as the sole protection for high-stakes matters until an independent audit exists; treat it as defense-in-depth, not a guarantee.
It is not a law-practice system. RVNT has no legal hold, retention, matter management, conflicts checking, or e-discovery export — and its forward secrecy plus device-only history can actively conflict with retention or preservation duties. Keep using your firm's document-management and compliance platform for the system of record.
End-to-end encryption protects the link, not the people on it. A client can screenshot, forward, or be compelled by their own subpoena; a compromised endpoint (malware, spyware, a seized unlocked device) defeats any messenger. RVNT cannot protect content on a compromised device, and the duress/panic features are bypassable under sophisticated coercion.
For genuinely life-or-liberty matters — a client facing state-level surveillance, a border crossing under duress, or whistleblower contact — established, audited tools plus professional operational-security and ethics guidance come first. RVNT is a complement to that advice, not a substitute for it.

Frequently asked questions

Can RVNT be subpoenaed for our privileged messages?

There is no central content store to subpoena. Per the threat model, conversation history lives only on user devices, and the server handles only public prekey bundles and peer discovery — it never holds message content, keys, IP logs, or sender/recipient pairs. A court order to RVNT cannot produce what RVNT never possessed. That protection does not extend to the devices in the conversation: a subpoena served on you or on your client can still compel production from a device, and a compromised device defeats any messenger. RVNT also has no e-discovery or legal-hold tooling, so it is not a system of record for matters you must preserve.

Does RVNT satisfy our duty of technological competence or make us compliant?

No tool makes a lawyer compliant; that is your professional judgment. The ABA's Rule 1.1 Comment 8 and Rule 1.6(c) frame a duty to understand technology and make reasonable efforts to protect client information — strong end-to-end encryption and sealed sender can be part of meeting that bar for sensitive communications. But RVNT carries no certification, audit, HIPAA capability, or BAA, and is pre-release. Decide its fit per matter with your firm's ethics and information-governance counsel.

How does this hide which client we are talking to, not just what we say?

Sealed sender encrypts the sender's identity inside the message envelope, so relays and network observers see only a 20-byte truncated recipient hash and an opaque ciphertext — not who is messaging whom. Combined with Tor routing and fixed-size padding, that frustrates the metadata inference (an attorney in frequent contact with a particular witness) that can reveal strategy or a sealed representation even when content stays encrypted. The recipient still learns the sender, by design, and a global passive adversary remains a documented limitation.

RVNT is a post-quantum, peer-to-peer, end-to-end-encrypted messenger with no phone number and no servers — open source, and honest about being early.

Get RVNT All use cases