End-to-End Encryption in Sparks for Teams
Sparks for Teams provides end-to-end encryption (E2EE) for chat messages (Matrix) as well as for 1:1 video calls and video meetings.
Group meetings: Unlike Microsoft Teams, meeting E2EE in Sparks is not limited to 1:1 calls. Group video meetings can also use end-to-end encryption when it is explicitly enabled (see the section below).
Sprache / Language: Deutsch
What is End-to-End Encryption?
With end-to-end encryption, content is encrypted before it is sent and only decrypted by the recipient. Only the conversation participants can read the data – no one else, including the infrastructure operators, has access.
E2EE for Chat Messages (Matrix)
All chat messages in encrypted rooms are end-to-end encrypted (Megolm protocol, Rust Crypto). Encryption is set up automatically:
Automatic Setup
When you first log in, SPARKS automatically sets up:
- Secret Storage – secure key management
- Cross-Signing – device verification
- Key Backup – backup of your encryption keys
No manual action required – everything happens in the background.
Encrypted Rooms
- New rooms can be created as encrypted (option when creating the room).
- Existing rooms can be encrypted later: Room settings → Privacy → “Enable encryption for this room”.
- In encrypted rooms, all messages are E2EE; only participants with the correct keys can read them.
Verify Sparks with Element
If you use Sparks alongside Element (or connect your own homeserver), compare devices via emoji/numbers: Connect your Matrix server and verify Sparks.
Second Device (Browser or Desktop App)
When you sign in on an additional device, your encryption keys are automatically restored:
- The recovery key is securely fetched from the server
- Secret Storage is opened with the existing key
- All older messages become decryptable
- The new device is automatically verified
No manual action needed – your messages are readable immediately.
Recovery Key
The recovery key is your emergency key in case automatic restoration doesn't work:
- It is stored securely on the server by default (AES-256-GCM encrypted)
- You can optionally copy/save it during the setup wizard
- It is displayed in Element-compatible format (can be entered in Element)
Strict Device Verification (Admin Option)
Your organization administrator can require that the recovery key is not stored on the server. In that case:
- You must save the recovery key yourself when first setting up
- You must manually enter the key or verify via SAS/QR on each new device
- The wizard will display the key and require confirmation that you saved it
Disable Matrix E2EE organization-wide (Admin Option)
Under Account → Team → Security policies, an admin can turn Matrix end-to-end encryption off for the whole organization. Then:
- No new encrypted rooms; crypto is not initialized on login
- E2EE-related options in the app are hidden (create room, security setup, “Start encrypted” on events, and similar)
- Device verification policy (comfortable/strict) does not apply while E2EE is off
Admin details: Team management – Security policies.
E2EE for 1:1 Calls
When E2EE is enabled for 1:1 calls:
- Audio: Your voice transmission is end-to-end encrypted.
- Video: Your video stream is end-to-end encrypted.
- Screen sharing: Shared view is also end-to-end encrypted when enabled.
Sparks uses an integrated video infrastructure for calls and meetings with support for end-to-end encryption.
Activation (1:1 Calls)
- Open Settings → Privacy
- Find the option End-to-end encrypted calls
- Toggle the switch on or off as desired
Important: For a 1:1 call to be end-to-end encrypted, both participants must have E2EE enabled.
E2EE for Video Meetings (Group Meetings)
Video meetings (group meetings) run by default without meeting E2EE. E2EE for meeting audio/video is only used when it is explicitly enabled – either via the calendar or via room settings.
When is a meeting E2EE-encrypted?
- Calendar appointments: When creating or editing an appointment, the organizer can set the option “Start encrypted” (or
startE2EEncrypted). The associated meeting chat is then created as an encrypted Matrix room, and the meeting uses a shared E2EE key (via Matrix room state). - Chat rooms (call from chat): In encrypted rooms, admins/moderators (power level ≥ 50) can enable or disable the option “Meeting end-to-end encryption” under Room settings → Privacy. Only when this option is on are calls/meetings from this room E2EE-encrypted.
Flow (calendar meeting with E2EE)
- Organizer creates an appointment with “Start encrypted”.
- When the meeting chat is opened for the first time, an encrypted Matrix room is created.
- When joining the meeting, the app fetches the shared meeting E2EE key from the Matrix room (or generates it on first join and stores it there).
- Audio and video in the meeting are then end-to-end encrypted.
Guests
Guests (participants without Matrix login, e.g. joining only via meeting link) have no access to the E2EE key. For them, the meeting runs without meeting E2EE (transport encryption still applies).
Where to find the settings
- Calendar: When creating/editing an appointment – option “Start encrypted” (if offered by the product).
- Chat room: Open room → Settings (gear) → Privacy tab → “Meeting end-to-end encryption” switch (only visible in encrypted rooms and only for admins/moderators).
Without E2EE
When E2EE is not enabled, calls and messages in Sparks are still transmitted with transport encryption. Your data is protected during transmission and at rest.
Decision guide: what does E2EE actually change?
Sparks separates three layers. Decide per layer — “everything on” maximizes privacy but is not right for every team or feature.
| Layer | Who controls it? | Typical question |
|---|---|---|
| Matrix chat E2EE (rooms) | Org admin (on/off) + room creator | Should chat content be readable only on participants’ devices? |
| Meeting E2EE (audio/video) | Organizer / room moderators (explicit) | Should meeting media also be end-to-end encrypted? |
| Device verification (Comfortable / Strict) | Org admin (only when Matrix E2EE is on) | May the recovery key live on the server, or only with users? |
Snapshot: benefit vs. limitation
| Topic | With E2EE | Without E2EE (transport encryption only) |
|---|---|---|
| Confidentiality | Operator/homeserver cannot read message or meeting media content | Infrastructure could theoretically see content (access control and policies still apply) |
| In-app assistant | In encrypted rooms: messages are often only readable locally; server-side chat content analysis is not possible | Plaintext events can be read by client tools and (when wired) server-side |
| Livedata MCP (external AI) | Scope matrix: E2EE events are returned as unavailable (unavailable: e2ee) | Unencrypted room messages can be read via MCP (with API key + scope) |
| Recording / transcript / captions | With meeting E2EE, typically unavailable or heavily limited | Meeting features such as recording and transcript work (subject to plan/policy) |
| Guests in meetings | Without Matrix login: no meeting E2EE key → guests join without meeting E2EE | Guests join via link as usual |
| Device change / support | Strict: keep the recovery key yourself; loss may lock old messages. Comfortable: easier setup; key stored encrypted on the server | No crypto setup required |
| Compliance / eDiscovery | IT/server cannot content-inspect historical chats | Easier server-side retention/inspection if the operator offers it |
Recommendations by scenario
| Scenario | Recommendation |
|---|---|
| Confidential 1:1 or project chats | Matrix E2EE on (org default); create encrypted rooms |
Org wants AI over chat content (assistant room context, MCP matrix) | Use unencrypted work rooms or turn Matrix E2EE off org-wide — and document the tradeoff deliberately |
| Standard team meetings with recording/transcript | Start the meeting without meeting E2EE; transport encryption remains |
| Highly sensitive meetings (no guests, no recording) | “Start encrypted” / meeting E2EE on; do not expect recording/transcript |
| Many devices, little IT support | Matrix E2EE on + Comfortable policy |
| Maximum key control, trained users | Matrix E2EE on + Strict policy (recovery key offline) |
For admins (Team → Security policies)
- Matrix E2EE On (default): Strongest chat protection; AI/MCP cannot see message bodies in encrypted rooms.
- Matrix E2EE Off: Conscious choice for easier integration (including server-readable chats for assistant/MCP). Transport encryption remains. Existing encrypted rooms may still hold local keys — plan before switching.
- Comfortable vs Strict: Comfortable eases onboarding; Strict avoids server-side recovery-key storage and increases support load.
How to switch: Team management – Security policies. External AI keys: Account → AI access / MCP.
For users
- Room E2EE and meeting E2EE are not the same. An encrypted chat does not automatically mean an E2EE meeting — and vice versa.
- If the assistant “cannot see messages” from a room, the room is often E2EE; that is intentional, not an AI bug.
- Under Strict, keep the recovery key offline; losing it can make old messages unreadable.