# What buff.systems sees

> The app’s trust model in plain words: end-to-end encryption, what passes through the buff.systems gateway, Apple and Google, what is stored on the phone.

The phone does not go into your company’s network directly — it and the installation meet at the
buff.systems gateway. The gateway exists so that the installation does not have to open ports to the outside, and the phone does not have to
know where it is. But **the gateway only passes envelopes along; it cannot open them.**

## End-to-end encryption

When pairing, the phone and the installation exchange keys and verify each other: via the QR code
(the secret in it does not go to the server) or by comparing six digits on two screens. From then on every
connection is encrypted with keys that **only the phone and the installation** have. One of the sides
cannot be swapped unnoticed — that is exactly what comparing the code checks.

## What the buff.systems gateway sees

**It sees** what is needed to deliver an envelope:

- that such-and-such phone is paired with such-and-such installation (by the identifiers of their keys) and the
  phone’s name, which is shown in the list of devices;
- when messages pass and how large they are;
- the address at which Apple or Google deliver notifications to this phone.

**It does not see** any of the content: no tasks, no code, no questions and answers, no notification
text, none of your decisions.

## Notifications, Apple and Google

Only Apple (APNs) and Google (FCM) can wake a closed app. The installation encrypts the notification text
**for a specific phone**, and it travels through buff.systems, Apple and Google
encrypted; the app itself decrypts it. On iPhone the system shows a Buff
notification once the app has opened and decrypted it.

## What is stored on the phone

- **The phone’s key** — created on the phone and never leaving it; kept in secure storage
  (Keychain on iPhone, Keystore on Android).
- **What you have read in the app** — so that screens open without a network. Stored encrypted;
  wiped when the installation is disconnected.
- **There is no workspace password on the phone**: the phone signs in with its own key.

The app contains no advertising and no third-party analytics, and does not collect data about you. The app’s
privacy policy is [on this page](/en/mobile/privacy).