Privacy & Encryption Technology

EchoLink is engineered around a single principle: your communications should be impossible to intercept, trace, or store by anyone other than the people in the conversation. Every layer of the platform — from the signaling handshake to the media transport to the chat data channel — is designed to leave no recoverable trace once a session ends.

Video and audio streams are protected with DTLS-SRTP, the same encryption standard used in secure telephony and enterprise conferencing systems. DTLS performs a certificate exchange at the start of the peer-to-peer connection, and SRTP then encrypts every media packet with symmetric keys that never leave the two endpoints. No relay server ever sees the unencrypted media, and no key material is transmitted to any third party.

Instant messages and file transfers flow over an SCTP data channel, which is itself encrypted with DTLS at the transport level. This means text and files are protected by the same cryptographic guarantees as the audio and video streams. Files are chunked, transmitted directly between peers, and held only in browser memory — once the session ends, every object URL is revoked and the underlying blobs are released for garbage collection.

EchoLink uses public STUN servers solely for NAT traversal — these servers help peers discover each other's network addresses but never carry media or message content. For environments where direct peer-to-peer connectivity is blocked by firewalls or restrictive networks, TURN relay servers can be configured to forward encrypted traffic without ever decrypting it. The relay sees only opaque encrypted packets.

When a call ends — whether by deliberate hang-up or by closing the browser tab — EchoLink executes a comprehensive zero-trace cleanup. It stops all camera and microphone tracks so the operating-system privacy indicators turn off immediately, closes the WebRTC peer connection and discards all ICE candidates, revokes every file blob and object URL, and clears both localStorage and sessionStorage. Nothing about the session persists on the device. This is what we call the Zero-Trace Guarantee: after you go dark, there is nothing left to find.