Key takeaways
- Stored content in C Chat is encrypted with AES-256.
- Each organization has its own encryption key, so teams are not protected by one shared key.
- Messages travel between devices and servers over TLS.
- Encryption at rest protects stored data; who can review group content is a separate question answered by auditable encryption.
- It is on for every team by default, including on the free plan.
When a vendor says “your messages are encrypted”, the useful follow-up questions are: encrypted where, with what, and with whose key? This page answers those questions for C Chat’s storage encryption, in terms a business owner or IT lead can repeat to a client.
What AES-256 at rest does in C Chat
AES-256 at rest is the protection applied to content while it sits in storage. C Chat combines two mechanisms:
- TLS in transit. Each message travels from your browser or phone to C Chat inside an encrypted TLS connection.
- AES-256 at rest with a per-organization key. Once stored, content is encrypted with AES-256, a widely used symmetric cipher, using a key that belongs to your organization rather than a key shared by every customer.
The idea behind encryption at rest is simple: if someone obtains a raw copy of the stored data, what they get is ciphertext. Separate keys per organization add a second boundary, explained in per-organization encryption keys explained and in the glossary entry on per-organization encryption keys.
How to use AES-256 at rest step by step
There is nothing to enable, so “using” this feature means knowing it is there and communicating it correctly:
- Create your team. From that moment your organization’s content is stored encrypted.
- Keep work content inside C Chat. Share documents with file sharing up to 25 MB instead of forwarding them through personal email or other apps.
- Describe it accurately to clients. Say “TLS in transit, AES-256 at rest with a key per organization”, and avoid calling it end-to-end.
- Pair it with good account hygiene. Remove people who leave and keep devices locked; storage encryption cannot help with an open, unlocked phone.
Real scenarios from business teams
- A property manager shares lease photos and maintenance invoices in a building group. If a storage backup is ever lost, the content in it is encrypted.
- A remote finance team exchanges spreadsheets in chat rather than over personal messengers. See secure messaging for remote teams and exchanging documents securely in chat.
- An IT lead filling in a vendor questionnaire needs a short, precise answer about storage encryption. “AES-256 at rest, separate key per organization, TLS in transit” covers it.
Privacy, permissions and limits
Encryption at rest is one layer, and it is worth being clear about what it does not do:
- It does not decide who can read content. Access rules do. In C Chat, team owners and admins can audit and export group conversations through auditable encryption, while direct messages between people stay private.
- It is not end-to-end encryption. Because content can be decrypted for authorized purposes, the platform can serve audits, moderation of reported messages and legal requirements. Platform access for those reasons is logged.
- It does not protect an unlocked device. If a phone is left open, anyone holding it sees what the account sees.
Tips for admins
- Use one team per organization or client entity when separation matters, so content falls under the right organization’s key.
- Document the model once. Point staff and clients to how C Chat encrypts your messages instead of improvising explanations.
- Remember the free-plan limits when planning separation: 50 members per team, 5 teams per account and 30 groups per team. Details are on the pricing page.
- Review access regularly. Encryption protects storage; your member list protects everything else.
Getting started
Open getcchat.com/c, sign up with phone or email, and create your team. Every message from then on is sent over TLS and stored with AES-256 under your organization’s own key. Read the full security overview when you need more detail.
Frequently asked questions
What does AES-256 at rest actually protect against?
It protects stored data if storage media, backups or database copies end up in the wrong hands. Without the right key, the stored messages are unreadable. It does not stop someone who already has access to an unlocked device or an authorized account from reading what that account can see.
Why does it matter that each organization has its own key?
A per-organization key separates your data cryptographically from other organizations on the same service. A problem limited to one organization's key does not automatically expose every other organization's content.
Is AES-256 at rest the same as end-to-end encryption?
No. End-to-end encryption keeps keys only on the participants' devices. C Chat uses TLS in transit and AES-256 at rest with per-organization keys, which allows team owners and admins to audit group conversations. That model is called auditable encryption.
Do I need to turn encryption on?
No. Encryption in transit and at rest applies to every C Chat team automatically from the first message. There is no setting a member can forget to enable.