XMPP.is

A free XMPP account service operated as an Unredacted sister project.

xmpp.is

Zero KYC
US
Evidence and facts →

A free XMPP account service operated as an Unredacted sister project.

Common useFederated XMPP messagingMessaging / Privacy ToolsOperator dataHosted

Identity checksZero KYCNo document check recorded · identity exposure level 0/4

Evidence and riskPartial evidenceCautionSome material claims still need confirmation.; those sources show trade-offs worth reading.

Last reviewedReviewed 17 Aug 2026KYC checked 17 Aug 2026 · verified jurisdiction · Source → official siteHow to cite this pageEvidence confidence72/100

Evidence and facts

JURISDICTIONUS

CAUTIONOMEMO and OTR are client-selected, not server-wide guarantees. XMPP.is says its info log records authentication but not user IP addresses, and names stored hashed passwords, offline messages, MAM archives, vCards, rosters, and enabled-module data. Its server page says uploads are limited to 100 MB and expire after one week, MAM is off by default with a published 30-day expiry, encrypted backups sync off-site daily, and a donated FlokiNET server is located in Romania; Unredacted Inc remains the US/Delaware operator. The current public Prosody config agrees on authentication/info logging and one-week uploads but sets MAM expiry to 90 days and PostgreSQL storage, conflicting with the site's 30-day and flat-file statements, so the running values are not independently confirmed. The deletion page says automated deletion is unavailable and strikes through its former emailed manual soft/hard procedure, so current deletion availability is unclear. Federation and XEP-0384 also leave traffic-analysis metadata outside client E2EE.

AUDITED BYNo audit listed

OPERATOR DATAHosted operator recorded

EVIDENCE CONFIDENCE

SELF-REPORTED5/5

Why evidence is 72/100Formula 3.1

Source coverageSome material claims still need confirmation: +42
Review ageAll recorded checks are within 30 days: +30

Full scoring method

LAST CHECKED2026-08-17

LAST UPDATED2026-08-17

Specs

DOCUMENT CHECKNone recorded

IDENTITY EXPOSURELevel 0/4

KYC TRIGGERSRegistration creates an XMPP account. An email address is optional for recovery; no document KYC commitment was found.

FEEFree

NETWORKSXMPP, OMEMO, OTR

CATEGORIESMessaging, Privacy Tools

COMMON USESFederated XMPP messaging, Accounts without phone numbers, Client-selected OMEMO encryption

FEATURESXMPP federation, Optional OMEMO, Optional OTR, MAM off by default, 100 MB uploads expiring after one week, Daily encrypted off-site backups, Public configuration source, Optional recovery email

TORNot listed

REGIONSGlobal availability

Review analysis, source material, related services, and history

About

A separately branded XMPP account and federation service operated by Unredacted Inc.

Corporate identity

Registry-sourced, not audited. The facts below come from cited web research rather than a direct registry query. Each claim links its own source.

LEGAL ENTITY: Unredacted Incsource ↗
INCORPORATED IN: Delaware, United Statessource ↗

Registry research · reviewed 2026-08-17

Frequently Asked Questions

Is identity verification required?

No identity verification is recorded for typical use. Registration creates an XMPP account. An email address is optional for recovery; no document KYC commitment was found.

Which payment methods are accepted?

Accepted payment methods: XMPP, OMEMO, OTR.

Where is it available?

Recorded availability: GLOBAL.

Is the operator based in a Five Eyes country?

Yes. The recorded jurisdiction is US, a Five Eyes country (US, UK, CA, AU, NZ). This is jurisdiction context and does not by itself establish that a service is safer or less safe.

How are identity, operator, and evidence fields reported?

Identity exposure is level 0 of 4. A hosted operator is recorded. Jurisdiction is shown as context, not a safety verdict. Evidence confidence is 72/100 and recorded risk is caution.

Which payment networks are supported?

Accepted networks: XMPP, OMEMO, OTR.

Related Services

addy.ioaddy.ioaddy.io · Email · GB

Email aliasing, self-hostable, crypto accepted.

Evidence94 Zero KYCCaution

About Visit ↗

Bitchatbitchat.freebitchat.free · Comms · ??

Bluetooth mesh messaging with Nostr relays.

Evidence100 Zero KYCCaution

About Visit ↗

Briarbriarproject.orgbriarproject.org · Comms · ??

Peer-to-peer messaging over Tor and Bluetooth.

Evidence94 Zero KYCCaution

About Visit ↗

Sources and history

Terms and privacy policy

No changes to the documents we watch since we started checking on 17 Aug 2026. Last checked 17 Aug 2026.

Service history

Latest meaningful changes to the facts shown on this provider page.

18 Aug 2026
Qualify xmpp deletion availability
Privacy warning
18 Aug 2026
Keep review dates and card copy within contracts
Checked at, Corporate / Reviewed at, Last reviewed, Updated at
18 Aug 2026
Align unredacted services with current sources
Checked at, Corporate / Reviewed at, Corporate / Source, Features, and 4 more

Full service history

18 Aug 2026updated
Qualify xmpp deletion availability
Privacy warning
OMEMO and OTR are client-selected, not server-wide guarantees. XMPP.is says its info log records authentication but not user IP addresses, and names stored hashed passwords, offline messages, MAM archives, vCards, rosters, and enabled-module data. Its server page says uploads are limited to 100 MB and expire after one week, MAM is off by default with a published 30-day expiry, encrypted backups sync off-site daily, and a donated FlokiNET server is located in Romania; Unredacted Inc remains the US/Delaware operator. The current public Prosody config agrees on authentication/info logging and one-week uploads but sets MAM expiry to 90 days and PostgreSQL storage, conflicting with the site's 30-day and flat-file statements, so the running values are not independently confirmed. Account deletion is an emailed manual request, not self-service. Federation and XEP-0384 also leave traffic-analysis metadata outside client E2EE.OMEMO and OTR are client-selected, not server-wide guarantees. XMPP.is says its info log records authentication but not user IP addresses, and names stored hashed passwords, offline messages, MAM archives, vCards, rosters, and enabled-module data. Its server page says uploads are limited to 100 MB and expire after one week, MAM is off by default with a published 30-day expiry, encrypted backups sync off-site daily, and a donated FlokiNET server is located in Romania; Unredacted Inc remains the US/Delaware operator. The current public Prosody config agrees on authentication/info logging and one-week uploads but sets MAM expiry to 90 days and PostgreSQL storage, conflicting with the site's 30-day and flat-file statements, so the running values are not independently confirmed. The deletion page says automated deletion is unavailable and strikes through its former emailed manual soft/hard procedure, so current deletion availability is unclear. Federation and XEP-0384 also leave traffic-analysis metadata outside client E2EE.
Review source: official site · public history entry
18 Aug 2026updated
Keep review dates and card copy within contracts
Checked at
2026-08-182026-08-17
Corporate / Reviewed at
2026-08-182026-08-17
Last reviewed
2026-08-182026-08-17
Updated at
2026-08-182026-08-17
Review source: official site · public history entry
18 Aug 2026updated
Align unredacted services with current sources
Checked at
2026-08-172026-08-18
Corporate / Reviewed at
2026-08-172026-08-18
Corporate / Source
Primary XMPP.is site and repository plus Unredacted policy and legal documentsPrimary XMPP.is security, server, deletion and transparency pages; pinned public configuration; and Unredacted legal documents
Features
XMPP federation, Optional OMEMO, Optional OTR, Public configuration source, Optional recovery emailXMPP federation, Optional OMEMO, Optional OTR, MAM off by default, 100 MB uploads expiring after one week, Daily encrypted off-site backups, Public configuration source, Optional recovery email
Last reviewed
2026-08-172026-08-18
Privacy warning
OMEMO and OTR are client-selected, not server-wide guarantees. Unredacted's policy lists username, optional email, user agent, optional contacts and rooms, and optional messages or uploads. Federation exposes metadata to participating servers, and XEP-0384 does not protect traffic-analysis metadata.OMEMO and OTR are client-selected, not server-wide guarantees. XMPP.is says its info log records authentication but not user IP addresses, and names stored hashed passwords, offline messages, MAM archives, vCards, rosters, and enabled-module data. Its server page says uploads are limited to 100 MB and expire after one week, MAM is off by default with a published 30-day expiry, encrypted backups sync off-site daily, and a donated FlokiNET server is located in Romania; Unredacted Inc remains the US/Delaware operator. The current public Prosody config agrees on authentication/info logging and one-week uploads but sets MAM expiry to 90 days and PostgreSQL storage, conflicting with the site's 30-day and flat-file statements, so the running values are not independently confirmed. Account deletion is an emailed manual request, not self-service. Federation and XEP-0384 also leave traffic-analysis metadata outside client E2EE.
Source reviewed
xmpp_is_site_repo_unredacted_policy_and_xep_0384_2026-08-17xmpp_is_security_server_deletion_and_public_config_2026-08-18
Updated at
2026-08-17T00:00:00.000Z2026-08-18
Review source: official site · public history entry
18 Aug 2026created
Add audited Unredacted services coverage
Provider profile
not setcreated
Review source: official site · public history entry

Only fields shown on the provider page are tracked. Private identifiers are never published.

Evidence basis: Claims on this page are linked to published sources for comparison, not certification, audit, endorsement, or recommendation; read the methodology and coverage map before relying on an entry.