Session

No phone number. No email. Just an ID. Decentralized encrypted messenger.

getsession.org

Zero KYC
CH
Evidence and facts →

No phone number. No email. Just an ID. Decentralized encrypted messenger.

Common useAnonymous messagingComms / Privacy ToolsOperator dataHosted

Identity checksZero KYCNo document check recorded · identity exposure level 0/4

Evidence and riskPartial evidenceCautionSome material claims still need confirmation.; those sources show trade-offs worth reading.

Last reviewedReviewed 5 Sep 2026KYC checked 5 Sep 2026 · inferred jurisdiction · Source → official siteHow to cite this pageSource coveragePartial evidenceRecorded riskCaution

Evidence and facts

CUNICULA SCORE 4.0

36/100Limited evidencePrivacy 12/25 · Control 0/20 · Transparency 0/20 · Security 17/25 · Accountability 7/10 · Cap 69 · Method

JURISDICTIONCH

CAUTIONInitial setup connects to an STF seed node that can see but says it does not record the IP address. Fast push notifications expose a device IP and token to Apple or Google and an account ID and token to an STF push server. The last official independent app audit located is from 2021. Development resumed in July 2026 with three developers, but resources remain highly constrained and funding still relies on donations and nonprofit grants.

AUDITED BYQuarkslab

OPERATOR DATAHosted operator recorded

SOURCE COVERAGE

Partial evidenceINDEPENDENT AUDIT1/6Reviewed 5 Sep 2026 · Source → official site

LAST CHECKED2026-06-24

LAST UPDATED2026-09-05

Specs

DOCUMENT CHECKNone recorded

IDENTITY EXPOSURELevel 0/4

KYC TRIGGERSNo phone number, no email. Session ID only. Decentralized message storage.

FEEFree

CATEGORIESComms, Privacy Tools

COMMON USESAnonymous messaging, No-account comms, Decentralized privacy

FEATURESNo phone number, No email required, End-to-end encrypted, Community-operated node network, Metadata-minimizing design, Open source, iOS, Android and Desktop, Onion routing

TORNot listed

REGIONSGlobal availability

Review analysis, source material, related services, and history

About

Decentralized encrypted messenger needing no phone number or email, stewarded by a Swiss foundation.

Analysis

OVERVIEW

Session is a decentralized messenger needing no phone number or email, only a generated Session ID, and its Quarkslab security audit is recorded as published with major findings resolved.

LIMITS

The 2026 funding review notes development resumed only in limited capacity after a donation campaign and long-term runway remains a watch item, and the project relocated from Australia to a Swiss foundation in 2024 after Australian police sought user data from an employee.

USEFUL FOR

People wanting phone-free, email-free messaging who are tracking the project's funding runway as an ongoing risk factor.

Sources · reviewed 2026-07-16

Session ↗

Corporate identity

Registry-sourced, not audited. The facts below come from cited web research rather than a direct registry query. Each claim links its own source.

LEGAL ENTITY: Session Technology Foundation (Session Technology Stiftung)source ↗
INCORPORATED IN: Switzerland (Zug)source ↗
REGISTERED ADDRESS: Bahnhofstrasse 7, 6300 Zug, Switzerlandsource ↗

PREVIOUSLY TRADED AS

Oxen Privacy Tech Foundation
Australia

source ↗

Registry research · reviewed 2026-08-08

We wrote about this

Frequently Asked Questions

Is identity verification required?

No identity verification is recorded for typical use. No phone number, no email. Session ID only. Decentralized message storage.

Which payment methods are accepted?

Please check the provider site for accepted payment methods.

Where is it available?

Recorded availability: GLOBAL.

Is the operator based in a Five Eyes country?

No. The recorded jurisdiction is CH, which is not a Five Eyes country. This is jurisdiction context and does not by itself establish that a service is safer or less safe.

How are identity, operator, and evidence fields reported?

Identity exposure is level 0 of 4. A hosted operator is recorded. Jurisdiction is shown as context, not a safety verdict. Source coverage is partial evidence, last reviewed 2026-09-05, and recorded risk is caution.

Related Services

addy.ioaddy.ioaddy.io · Email · GB

Email aliasing, self-hostable, crypto accepted.

Cunicula score68/100Source coverageCurrent Zero KYCCaution

About Visit ↗

BTCPay Serverbtcpayserver.orgbtcpayserver.org · Merchants ·

Self-hosted Bitcoin and Lightning payments.

Cunicula scoreNot ratedSource coveragePartial Zero KYCCaution

About Visit ↗

Calyx Institutecalyxinstitute.orgcalyxinstitute.org · Privacy Tools · US

US nonprofit privacy tools and hotspots.

Cunicula scoreNot ratedSource coverageCurrent Light KYCCaution

About Visit ↗

Compare

Compare withSimpleX ChatKYC, privacy, evidence, risk, fees, limits, jurisdiction, audits, and features.

Sources and history

Terms and privacy policy

No changes to the documents we watch since we started checking on 9 Aug 2026. Last checked 9 Aug 2026.

Service history

Latest meaningful changes to the facts shown on this provider page.

5 Sep 2026
Review overdue providers against current sources
Features, KYC last checked, Last reviewed, Privacy warning, and 2 more
26 Aug 2026
Apply full-service rereview and score 4.0
Privacy warning, Score assessment
9 Aug 2026
Corporate registry information updated
Corporate / Entity type

Full service history

5 Sep 2026updated
Review overdue providers against current sources
Features
No phone number, No email required, E2E encrypted, Decentralized network, No metadata collection, Open source, iOS + Android + Desktop, Onion routingNo phone number, No email required, End-to-end encrypted, Community-operated node network, Metadata-minimizing design, Open source, iOS, Android and Desktop, Onion routing
KYC last checked
2026-03-132026-09-05
Last reviewed
2026-07-052026-09-05
Privacy warning
The app requires an initial connection to an STF-organised seed node, which can see but says it does not record the connecting IP; Apple/Google may collect OS telemetry. The only cited independent code audit is from 2021, while 2026 development resumed with a reduced three-developer team funded mainly by donations.Initial setup connects to an STF seed node that can see but says it does not record the IP address. Fast push notifications expose a device IP and token to Apple or Google and an account ID and token to an STF push server. The last official independent app audit located is from 2021. Development resumed in July 2026 with three developers, but resources remain highly constrained and funding still relies on donations and nonprofit grants.
Source reviewed
older source, not independently verifiedhttps://getsession.org/app-privacy-policy
Updated at
2026-03-132026-09-05
Review source: official site · public history entry
27 Aug 2026updated
Reconcile score 4.0 evidence
Score assessment / Control model
hosted-accountunknown
Score assessment / Operator data exposure
moderateunknown
Score assessment / Source model
openunknown
Score review
not setOutcome: HOLD; Checked at: 2026-08-25; Inputs: Operator data exposure: unknown; Control model: unknown; Source model: unknown; Audit: Score eligible: no; Reason: No dated, scoped, current audit citation was normalized in the reviewed packet; legacy auditedBy labels receive no score credit.
Review source: older source, not independently verified · public history entry
26 Aug 2026updated
Apply full-service rereview and score 4.0
Privacy warning
Originally Australian (Five Eyes). Relocated to Swiss non-profit (Session Technology Foundation) November 2024 after Australian police visited an employee seeking user data. Switzerland has its own surveillance laws but the relocation significantly reduces compulsion risk. Quarkslab security audit published - all major findings resolved.The app requires an initial connection to an STF-organised seed node, which can see but says it does not record the connecting IP; Apple/Google may collect OS telemetry. The only cited independent code audit is from 2021, while 2026 development resumed with a reduced three-developer team funded mainly by donations.
Score assessment
not setOperator data exposure: moderate; Control model: hosted-account; Source model: open
Review source: older source, not independently verified · public history entry
9 Aug 2026updated
Corporate registry information updated
Corporate / Entity type
not setcompany
Review source: older source, not independently verified · public history entry
8 Aug 2026updated
Corporate registry information updated
Corporate
not setLegal entity: Session Technology Foundation (Session Technology Stiftung); Incorporation jurisdiction: Switzerland (Zug); Registered address: Bahnhofstrasse 7, 6300 Zug, Switzerland; Officers: none; Prior entities: Oxen Privacy Tech Foundation (Australia)
Review source: older source, not independently verified · public history entry
8 Aug 2026updated
Provider summary rewritten
Description
Decentralized encrypted messenger requiring no phone number or email. Swiss foundation stewardship, no registration, no metadata collection claim. 2026 funding review: development resumed in limited capacity after a donation campaign, but long-term runway remains a watch item.Decentralized encrypted messenger needing no phone number or email, stewarded by a Swiss foundation.
Review source: older source, not independently verified · public history entry
7 Aug 2026updated
Provider summary rewritten
Card summary
not setEncrypted messenger without phone or email.
Review source: older source, not independently verified · public history entry
6 Aug 2026updated
Make service ratings transparent
Evidence status
verifiedpartial
Review source: older source, not independently verified · public history entry
6 Aug 2026updated
Provider presentation updated
Evidence status
not setverified
Privacy warning
Originally Australian (Five Eyes). Relocated to Swiss non-profit (Session Technology Foundation) November 2024 after Australian police visited an employee seeking user data. Switzerland has its own surveillance laws but the relocation significantly reduces compulsion risk. Quarkslab security audit published — all major findings resolved.Originally Australian (Five Eyes). Relocated to Swiss non-profit (Session Technology Foundation) November 2024 after Australian police visited an employee seeking user data. Switzerland has its own surveillance laws but the relocation significantly reduces compulsion risk. Quarkslab security audit published - all major findings resolved.
Recorded risk
not setcaution
Trust level
cautionnot set
Review source: older source, not independently verified · public history entry
5 Jul 2026updated
Clear freshness review queue
Description
Decentralized encrypted messenger requiring no phone number or email. Messages stored on the Oxen Service Node Network. End-to-end encrypted, no metadata collection.Decentralized encrypted messenger requiring no phone number or email. Swiss foundation stewardship, no registration, no metadata collection claim. 2026 funding review: development resumed in limited capacity after a donation campaign, but long-term runway remains a watch item.
Last reviewed
2026-03-132026-07-05
Review source: older source, not independently verified · public history entry
24 Jun 2026updated
Provider facts reviewed and updated
Checked at
2026-03-132026-06-24
Review source: older source, not independently verified · public history entry
22 Jun 2026updated
Ship trust audit remediation pass
Jurisdiction confidence
not setinferred
KYC last checked
not set2026-03-13
Last reviewed
not set2026-03-13
Source reviewed
not setolder source, not independently verified
Review source: older source, not independently verified · public history entry
7 Apr 2026updated
Drop warrantCanary trust signal
Warrant canary
nonot set
Review source: source not recorded · public history entry
29 Mar 2026updated
KYC risk level system + advanced directory filters
KYC level
zero0
Review source: source not recorded · public history entry
14 Mar 2026updated
Offline status bug, vetted grid, news/projects img tags
Status
liveok
Review source: source not recorded · public history entry
14 Mar 2026created
Provider presentation updated
Provider profile
not setcreated
Review source: source not recorded · public history entry

Only fields shown on the provider page are tracked. Private identifiers are never published.

Evidence basis: Claims on this page are linked to published sources for comparison, not certification, audit, endorsement, or recommendation; read the methodology and coverage map before relying on an entry.