Skip to main content
Genie9

Security Practices - Nygma

Last Updated: October 13, 2026

This page explains how Genie9 LTD (“Genie9”, “we”, “us”) protects Nygma — the web app at nygma.genie9.com and the Nygma apps for Android and iOS — and what these measures do not protect against. It describes how Nygma works today. It is not a guarantee, a warranty or a service-level commitment. For exactly what we can and cannot see, read our Zero-Knowledge Statement.

1. Encryption on Your Device

1.1 Drives and Files

  • • Your files are kept in drives. Each drive has its own drive password, which you choose. Your drive password never leaves your device.
  • • Before anything is uploaded, your device encrypts the file contents, the names of files and folders, thumbnails, and file details (metadata).
  • • Drives use AES-256-GCM on all plans, or ChaCha20-Poly1305 on the Professional plan and above.

1.2 Keys

  • • Your device derives the drive’s master key from your drive password with PBKDF2-SHA256 (100,000 iterations) and a random salt for that drive.
  • • The keys that encrypt a drive’s files are stored on our servers only in wrapped (encrypted) form, locked with the drive’s master key.
  • • In the current format, each part of each file — contents, name, details and each thumbnail — is encrypted with its own key, derived with HKDF-SHA256, and its own random nonce, and is bound to that file so parts cannot be swapped between files.
  • • To check your drive password, our server keeps only a verifier derived one way from the master key. The verifier cannot be used to unlock your drive.

1.3 Files Uploaded Before Nygma 1.0

Files uploaded before Nygma 1.0 use our first encryption format, which gives weaker protection to file names and image previews. Section 7 of our Zero-Knowledge Statement explains what this means and how to move a file to the current format.

2. Signing In and Your Account

  • • Nygma has no account password. You sign in with a 6-digit code sent to your email address or, in the mobile apps, with Sign in with Google or Sign in with Apple.
  • • On the web you can turn on two-factor authentication with an authenticator app (TOTP). You get backup codes when you turn it on.
  • • We limit repeated wrong sign-in codes.
  • • Signing out ends your session on every device.
  • • Deleting your account must be confirmed with a code sent to your email address.

3. Protecting Your Drives

3.1 Unlocking and Recovery

  • • PIN: you can set an optional 6-digit PIN on a device for quick unlocking. In the mobile apps the PIN also needs your device’s biometrics. Our server checks a proof of the PIN before it releases anything, and blocks PIN unlocking after repeated wrong tries. Please read the PIN limit in section 7.
  • • Recovery phrase: each drive can have a recovery phrase. If you lose both your drive password and your recovery phrase, your data is gone for good. Genie9 cannot reset your drive password or recover your data.
  • • App Lock: in the mobile apps you can require your device’s biometrics or passcode to open Nygma.
  • • Screen privacy: in the mobile apps, screenshots and app-switcher previews are blocked while a drive is open or your recovery words are on screen.

3.2 Duress Mode and Time Bomb

  • • Duress mode (paid plans): you can set a duress password that opens a decoy drive you prepare. When the duress password is used, every other open drive is locked. Duress mode is designed for the moment someone forces you to open Nygma on your device. It does not hide the decoy from our servers — see section 7.
  • • Time Bomb (off unless you turn it on): if you are inactive for a period you choose — from 7 to 365 days — Nygma deletes all of your drives and files, with warning emails first or silently, as you choose. This cannot be undone. Genie9 is not liable for data deleted as you configured it.

3.3 Share Links and Trash

  • • Share links are protected by a password you choose and can have an expiry date. The link password never reaches us. A link opens only the items you chose, and you can revoke it at any time.
  • • Items you delete go to Trash. Trash is emptied automatically after 30 days.

4. Nygma Chat

  • • Nygma Chat (in the mobile apps) is end-to-end encrypted: messages, photos, videos, files, voice messages and locations are encrypted on your phone and can be decrypted only on the phone of the person you are chatting with.
  • • You can chat only with people you invite, or who invite you, by QR code or one-time link. Invitations expire within 48 hours. There is no directory, search or random matching.
  • • The two phones agree keys using X25519 combined with ML-KEM-768. After that, keys keep changing as messages are exchanged (a double ratchet). Messages are encrypted with ChaCha20-Poly1305 and padded to a fixed size.
  • • Chats open with a Chats PIN. You can set a timer that deletes messages from both phones, and you can block a contact.
  • • Notifications carry no content. They say only “New activity”.
  • • Our servers hold encrypted messages only until they are delivered, and for no more than 30 days. We cannot read your chats and we do not scan them.

5. In Transit and on Our Servers

  • • Connections to Nygma use TLS (HTTPS).
  • • The mobile apps use certificate pinning for our servers: they connect only when the server’s certificate comes from one of the certificate authorities built into the app.
  • • Our servers are hosted by Amazon Web Services in the United States (us-east-1). Encrypted files are stored in Amazon S3 under random identifiers, our database runs on Amazon RDS, and emails are sent through Amazon SES.
  • • Because files are encrypted on your device before upload, what we store for your files is encrypted data.

6. What We Can See

Encryption on your device does not hide everything. We can see, for example, your account email address and name, the names of your drives, file sizes, counts and timestamps, your plan and billing records, and IP addresses in our logs. The full list is in our Zero-Knowledge Statement.

7. What These Measures Do Not Protect Against

  • • Your devices. Nygma cannot protect your data on a device that has malware, has been compromised, or is used by someone else while a drive is open. If you keep offline copies on your phone, their safety also depends on your phone’s security.
  • • Weak passwords. Our server keeps a verifier for each drive password. Like any password check, it can be attacked by guessing if the password is weak. For ChaCha20 drives created before Nygma 1.0, a guess can be checked more cheaply. Use a long, unique drive password.
  • • PINs. A PIN has only six digits. When you set one, your drive’s keys are also stored on our servers wrapped with a key made from the PIN, and that copy is sealed with a key held on our servers. Someone who had both our database and that server key could try every possible PIN and open the drive. If you need the strongest protection for a drive, do not set a PIN on it.
  • • Duress mode. Our servers know which drive is your decoy and record when the duress password is used. Duress mode does not protect you against anyone who obtains data from us.
  • • Older files. Files uploaded before Nygma 1.0 have weaker protection for their names and image previews (see section 1.3).
  • • Lost passwords. If you lose your drive password and your recovery phrase, we cannot help you get your data back.
  • • No system is perfectly secure. We do not guarantee that Nygma is free of vulnerabilities or that it will never be breached.

8. Reporting a Security Problem

8.1 Vulnerabilities

  • • Email support@genie9.com with “Security” in the subject line, and include the steps needed to reproduce the problem.
  • • Please do not access, change or delete other people’s data, disrupt the service, or publish details before we have had a reasonable chance to fix the problem.
  • • We do not offer rewards for reports and we do not promise a response time.

8.2 Abuse, Illegal Content and Child Safety

Email abuse@genie9.com, or use Report a problem in the app. We acknowledge abuse reports within 48 hours.

9. Security Incidents

If a personal data breach affects you, we will tell you and the regulator where the law requires us to.

10. Liability and Changes

  • • This page is for information. Your use of Nygma is governed by the Nygma Terms of Service, including its limits on our liability.
  • • We may change our security measures at any time, for example to improve them. When we do, we will update this page.

11. Contact Information

Security reports and general questions:

Email: support@genie9.com

Abuse reports:

Email: abuse@genie9.com

Privacy and data protection:

Email: privacy@genie9.com or dpo@genie9.com

Legal:

Email: legal@genie9.com

Mailing Address:

Genie9 LTD

3 Shortlands

London W6 8DA

United Kingdom

This Security Practices page was last updated on October 13, 2026.

← Back to Nygma Legal Center