Z is built by Secured Cyber Solutions, an independent security company in London.
Most messengers ask you to trust an operator: to hold your phone number, your contact graph and your account, and not to look. Z is an attempt to build one where that trust is not required — where the server is designed to be useless to an attacker who takes it, and where the claims are specified precisely enough that someone else can check them.
The protocol is published and frozen, the test vectors are in the repository, and every change is re-verified by independent implementations before it ships. Design decisions that affect the security model are written down as records in the open, including the ones that record a mistake and its correction.
Source-available under the Z Messenger Licence: you may read it, build it and self-host it for personal use. Commercial use and redistribution need written permission.
Security reports and everything else: [email protected]. If you are reporting a vulnerability, say so in the subject line and we will reply before doing anything else.