> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enigm.io/llms.txt
> Use this file to discover all available pages before exploring further.

# FAQ

> Frequently asked questions about Enigm products, privacy, security, device trust, and support boundaries.

A collection of common questions about the Enigm ecosystem.

## Products

<AccordionGroup>
  <Accordion title="What is Enigm?">
    Enigm is the private messaging product in the Enigm ecosystem. It provides secure messaging, secure calls, PIN-gated app access, device association, Active Defense, multi-device workflows, Enigm Proxy traffic separation, and VPN Service usage. Account creation is performed through Enigm Command.
  </Accordion>

  <Accordion title="What is Enigm Command?">
    Enigm Command is the web control panel for account creation, account lifecycle, critical-operation PIN authorization, device visibility, session control, Enigm Server management, Enigm eSIM management, Enigm Key device visibility, product lifecycle, training, payment workflows, and managed-device operations.

    Enigm Command is not a messaging client and does not provide plaintext access to messages, attachments, calls, or private keys.
  </Accordion>

  <Accordion title="What is Enigm Link?">
    Enigm Link is the official USB secure environment governed through Enigm Command. It provides desktop apps for macOS, Windows, and Linux, plus Enigm Link Boot OS for compatible computers.

    Enigm Link is designed to open Enigm Command and supported Enigm web surfaces from a protected temporary environment with official device validation, VPN-required protected state, and controlled update workflows. It is not a messaging product and does not replace Enigm, Enigm OS, or Enigm Server.
  </Accordion>

  <Accordion title="What is Enigm Server?">
    Enigm Server is a dedicated private messaging environment for approved Enigm users. It supports controlled membership, server ID join requests, administrator approval, region selection, and lifecycle control over server-scoped encrypted content.

    Server administrators can manage membership and encrypted content availability. They cannot read message plaintext, attachment plaintext, user communications, or private key material.
  </Accordion>

  <Accordion title="What is Enigm OS?">
    Enigm OS is a secure operating system designed to provide additional Device Trust, platform hardening, Trust Security Center visibility, network policy controls, controlled device management, and secure update governance.

    Enigm OS strengthens device posture, but it does not replace end-to-end encryption, user trust decisions, secure messaging architecture, or security awareness.
  </Accordion>

  <Accordion title="What is Enigm Key?">
    Enigm Key is a physical emergency key device. It allows a user to trigger an SOS workflow that notifies selected contacts and shares event-bound location information until the user cancels the emergency sending workflow.

    Enigm Key remains dormant during normal non-emergency operation to support user privacy.
  </Accordion>

  <Accordion title="What is Enigm eSIM?">
    Enigm eSIM is a private connectivity product focused on data-only mobile connectivity. It is purchased and managed through Enigm Command and linked to the user's Enigm account.

    Enigm eSIM is separate from secure messaging, end-to-end encryption, Enigm Proxy, VPN Service, and Device Trust.
  </Accordion>
</AccordionGroup>

## eSIM And Connectivity

<AccordionGroup>
  <Accordion title="Is Enigm the mobile network operator for Enigm eSIM?">
    No. Enigm provides Enigm eSIM as a commercial facilitation and lifecycle-management service. Enigm is not a mobile network operator, mobile virtual network operator, telecommunications carrier, radio access network operator, or direct issuer of the underlying carrier connectivity.

    The underlying mobile data service is operated by an independent telecommunications infrastructure provider.
  </Accordion>

  <Accordion title="Can Enigm provide carrier network logs for Enigm eSIM?">
    Enigm does not operate the carrier network and does not receive carrier-layer traffic records as part of normal Enigm eSIM operation.

    Enigm cannot provide carrier network traffic records, carrier IP allocation logs, carrier connection logs, or carrier-side telecommunications records that are held only by an independent telecommunications infrastructure provider.
  </Accordion>

  <Accordion title="Who is responsible for local eSIM compliance?">
    Users and organizations are responsible for understanding and complying with telecommunications, identity-registration, sanctions, export-control, lawful-use, and network-use requirements in the jurisdictions where they purchase, activate, or use Enigm eSIM.

    Enigm eSIM is a commercial facilitation and lifecycle-management service. Enigm is not a mobile network operator, MVNO, telecommunications carrier, or issuer of the underlying carrier connectivity.
  </Accordion>
</AccordionGroup>

## Account And Access

<AccordionGroup>
  <Accordion title="Does Enigm require email, phone number, or identity document for standard account registration?">
    Standard Enigm account creation is performed through Enigm Command and is designed to minimize dependency on public identifiers. Enigm does not require email address, phone number, or identity document collection for normal account registration.
  </Accordion>

  <Accordion title="How does the Enigm PIN work?">
    During Enigm Command onboarding, the user defines a 6-digit numeric PIN. Enigm App uses the PIN for access after authentication, and Enigm Command uses it for critical operations such as data deletion and account deletion.

    PIN validation is performed against the Enigm server-side security layer. It is not a local-only device check.
  </Accordion>

  <Accordion title="What happens after repeated incorrect PIN attempts?">
    If the PIN is entered incorrectly 5 times, Enigm App closes the app session and records a profile risk state visible to contacts.

    The risk state is cleared only after the user successfully validates with the correct PIN.
  </Accordion>

  <Accordion title="What is the reverse PIN?">
    When enabled by the user, the reverse PIN is a distress-oriented workflow. Entering it triggers protected-content deletion according to the data-deletion and retention model and records a profile risk state visible to contacts.

    Reverse PIN deletion removes messages, voice messages, call records, multimedia, attachments, and other protected conversation content available to the account. It does not delete the Enigm account itself.
  </Accordion>

  <Accordion title="Can users be searched by username or display name?">
    No. Contacts are added through a unique contact identifier. Users cannot be searched by username or display name.
  </Accordion>
</AccordionGroup>

## Privacy And Cryptography

<AccordionGroup>
  <Accordion title="What data does Enigm minimize?">
    Enigm is designed around data minimization, identity minimization, metadata reduction, privacy-preserving identifiers, content confidentiality, and user control.

    The platform collects and retains only the information required to operate services, provide security functions, maintain platform integrity, support lawful compliance obligations, and preserve operational reliability.
  </Accordion>

  <Accordion title="Can Enigm read messages or attachments?">
    Enigm administrative systems are not intended to provide plaintext access to messages, attachments, secure call content, media, or user conversations.

    Server-side message storage, where required for delivery, stores encrypted content objects.
  </Accordion>

  <Accordion title="Are metadata and operational identifiers protected?">
    Metadata and operational identifiers are minimized, purpose-limited, access-controlled, and partially encrypted where the relevant product or storage domain supports it. Enigm uses privacy-preserving identifiers where device or lifecycle correlation is required.

    Some operational identifiers remain necessary to route services, authenticate requests, enforce lifecycle controls, support security monitoring, and maintain platform integrity.
  </Accordion>

  <Accordion title="How does Enigm protect messages?">
    Enigm messaging uses end-to-end encryption. Message access depends on trusted device association and protected key material. Administrative controls do not grant message plaintext access.
  </Accordion>

  <Accordion title="How are keys protected?">
    Keys are generated on the device. Private key material is intended to remain device-bound, protected by secure device storage, and protected by hardware-backed mechanisms where available.

    On iOS, protected storage uses Keychain and Secure Enclave capabilities where available. On Android, protected storage uses the platform keystore and hardware-backed key protection where available.
  </Accordion>

  <Accordion title="Does Enigm use post-quantum cryptography?">
    Enigm incorporates post-quantum cryptographic algorithms standardized by NIST as part of its cryptographic architecture.

    This statement does not mean that Enigm itself is certified, approved, or audited by NIST.
  </Accordion>
</AccordionGroup>

## Security And Trust

<AccordionGroup>
  <Accordion title="What is Active Defense?">
    Active Defense is an Enigm App security capability available in production to a selected user pool. It analyzes security-relevant network behavior over a bounded assessment period to help identify suspicious mobile malware or spyware risk patterns.

    Active Defense does not inspect message plaintext, call content, attachments, media, documents, user conversations, private keys, or recovery phrases.
  </Accordion>

  <Accordion title="What is App Runtime Protection?">
    App Runtime Protection is the Enigm App hardening layer for app shielding, code protection, root and jailbreak risk detection, anti-tampering, anti-debugging, runtime integrity, and instrumentation detection.

    It hardens the app runtime and contributes Device Trust signals. It does not replace end-to-end encryption, protected key material, PIN validation, server-side authorization, or Active Defense.
  </Accordion>

  <Accordion title="What is Device Trust?">
    Device Trust is the evaluation of whether a device should be treated as trusted for account, messaging, or management workflows. Device Trust is separate from Account Trust, administrative authorization, Remote Attestation, and OTA eligibility.
  </Accordion>

  <Accordion title="What is Trust Security Center?">
    Trust Security Center is the local Enigm OS device trust evaluation system. It evaluates device security signals and presents user-visible trust states: Protected, Review Required, and Inactive.

    Trust Security Center is not an antivirus and not a numeric security score.
  </Accordion>
</AccordionGroup>

## Administration And Governance

<AccordionGroup>
  <Accordion title="Can administrators bypass encryption?">
    No. Administrative authority can manage lifecycle, membership, devices, sessions, product state, and encrypted content availability where authorized. It does not provide cryptographic authority or plaintext access.
  </Accordion>

  <Accordion title="Does Enigm monitor protected message content?">
    No. Enigm does not operate a general monitoring model for message plaintext, attachment plaintext, secure call content, media content, or user conversations.

    Abuse, legal, or security review is limited to Enigm-held records and authorized lifecycle controls. End-to-end encryption and protected key material remain separate from administrative visibility.
  </Accordion>

  <Accordion title="Is Enigm Key an emergency service?">
    No. Enigm Key is a user-controlled emergency alerting workflow for selected contacts. It is not an emergency service, public safety answering point, rescue dispatch service, medical service, or guaranteed response system.

    Emergency alert delivery and event-bound location sharing depend on device state, mobile connectivity, service availability, account association, selected contacts, and user configuration.
  </Accordion>

  <Accordion title="Does payment privacy remove all financial linkage?">
    No. Payment Privacy is designed to reduce unnecessary identity linkage inside Enigm's product architecture. It does not remove all financial linkage, tax obligations, sanctions obligations, chargeback exposure, or lawful financial reporting obligations outside Enigm's control.
  </Accordion>

  <Accordion title="Can Enigm export user data?">
    Enigm does not currently provide user data export workflows. Enigm cannot export plaintext messages, plaintext attachments, secure call content, private keys, or data that is technically unavailable.
  </Accordion>

  <Accordion title="Is Enigm ISO 27001 certified?">
    Yes. Enigm maintains ISO/IEC 27001:2022 certification for the documented certified scope. The certified scope covers the information security management system supporting encrypted messaging application development activities, including related development governance, supporting development infrastructure, internal security policies, and company processes included in the Statement of Applicability. The public certificate is available in Security Governance.
  </Accordion>

  <Accordion title="Are security audits public?">
    Enigm maintains private assessment evidence under NDA, including cryptographic assessment, penetration testing, mobile application assessment, infrastructure assessment, and broader security review materials.
  </Accordion>

  <Accordion title="How many legal requests has Enigm received?">
    The public transparency report lists zero legal requests for 2024, 2025, and 2026.
  </Accordion>

  <Accordion title="Can Enigm notify users about legal requests?">
    Enigm does not currently provide a user-notification mechanism for legal requests.
  </Accordion>
</AccordionGroup>