WHAT THE POLICIES SAY

Signal is an end-to-end encrypted messaging and calling app operated by Signal Messenger LLC under the Signal Technology Foundation, a 501(c)(3) nonprofit funded at its 2018 creation with USD 50 million from WhatsApp co-founder Brian Acton. Its privacy policy states that account registration requires only a phone number, that Signal cannot decrypt or access the content of messages or calls, and its published responses to government subpoenas show the only subscriber data it can produce is the Unix timestamp of account creation and last connection. Its sealed sender feature is designed to hide who is messaging whom even from Signal itself. In 2022 a phishing breach at Twilio, Signal's phone-verification vendor, exposed the phone numbers of roughly 1,900 Signal users; message content and history were not affected.

TIMELINE

NO ENTRIES ON FILE YET.

TOOLS WE RECOMMEND

PLUS

RECEIPTS

13 ON FILE

[2018-05-25] · COLLECTION

Signal's privacy policy, effective 2018-05-25, states that creating a Signal account requires registering a phone number, that profile name and picture are optional additions, and that Signal cannot decrypt or otherwise access the content of messages or calls.

signal.org ↗

[2021-10-28] · COLLECTION

In its published response to a federal grand jury subpoena from the Central District of California, dated 2021-10-28, Signal stated that the only account and subscriber information it can provide is Unix timestamps for when each account was created and the date each account last connected to the Signal service; messages, chat lists, groups, contacts, call records, and profile information do not exist on Signal's servers due to end-to-end encryption by default.

signal.org ↗

OWNERSHIP TRANSPARENCY

Signal Technology Foundation's nonprofit filings are public under EIN 82-4506840 through ProPublica's Nonprofit Explorer, which republishes the organisation's IRS Form 990 disclosures covering finances, governance, and officer compensation.

projects.propublica.org ↗

[2018-02-21] · OWNERSHIP TRANSPARENCY

Signal announced on 2018-02-21 the creation of the Signal Technology Foundation, a 501(c)(3) nonprofit made possible by an initial USD 50,000,000 in funding from WhatsApp co-founder Brian Acton, who serves as Executive Chairman, with the stated mission of developing open source privacy technology that protects free expression and enables secure global communication.

signal.org ↗

[2018-05-25] · SHARING

Signal's privacy policy discloses two sharing surfaces: third-party providers that send a verification code to the user's phone number at registration, and disclosure where required to meet applicable law, regulation, legal process or enforceable governmental request, or to address fraud, security or technical issues. The policy describes no advertising, analytics, or data-partner sharing.

signal.org ↗

TRACK RECORD

Signal maintains a public page publishing the government data requests it has received together with its formal responses, including grand jury subpoenas from the Central District of California and the District of Columbia and a Santa Clara County search warrant -- a standing transparency practice through which its minimal-data claims have been repeatedly tested in court records.

signal.org ↗

TRACK RECORD

A formal security analysis of Signal's PQXDH post-quantum key agreement protocol, presented at the USENIX Security '24 symposium by Karthikeyan Bhargavan and Franziskus Kiefer of Cryspen, Charlie Jacomme of Inria Nancy Grand-Est, and Rolfe Schmidt of Signal Messenger, specified the protocol and analysed it with the ProVerif and CryptoVerif formal verification tools. The authors report that the flaws they identified in the specification were not exploitable in the Signal application, and that they collaborated with the protocol designers on an updated specification in which each change was formally verified.

usenix.org ↗

TRACK RECORD

Signal operates a published coordinated vulnerability-disclosure channel: its Security page invites reports to a dedicated security address and maintains a public acknowledgments list crediting outside reporters by name and month, with entries running from September 2025 through July 2026 and earlier credits recorded in the commit history of Signal's repositories. Signal does not publish bounty amounts or a separate scope document on this page.

signal.org ↗

[2016-10-04] · TRACK RECORD

Signal's published account of a 2016 federal grand jury subpoena from the Eastern District of Virginia, dated 2016-10-04, states that the subpoena arrived with a broad gag order, that the ACLU represented Signal in successfully removing that gag order, and that Signal published the subpoena, its response, its petition to remove the gag order, the government's response and the unsealing order. Signal states the only information it could produce was the date and time a user registered and the last date of that user's connectivity.

signal.org ↗

[2022-08-15] · TRACK RECORD

As reported by TechCrunch on 2022-08-15, Signal stated it would notify about 1,900 users whose phone numbers or SMS verification codes were exposed when attackers gained access to the customer support console of Twilio, Signal's phone-number verification vendor, through a phishing attack. Signal stated that message history, contact lists, profile information, and blocked-user data were not affected.

techcrunch.com ↗

[2025-10-02] · TRACK RECORD

In a post dated 2025-10-02 announcing the Sparse Post Quantum Ratchet, Signal states that it partnered with the security firm Cryspen to make formal verification part of the protocol design process from the beginning, that the resulting design carries machine-verified proofs, and that the verification is re-run in Signal's continuous integration pipeline on every change so that a failing proof fails the build. Signal also names researchers from PQShield, AIST and NYU as collaborators on the underlying published research.

signal.org ↗

[2018-05-25] · TRACKING TECH

Signal's privacy policy states that calls and messages are always end-to-end encrypted so they can never be shared or viewed by anyone but the sender and intended recipients -- encryption is the default for all communications, not an optional mode.

signal.org ↗

[2018-10-29] · TRACKING TECH

Signal's sealed sender feature, announced 2018-10-29, is designed to hide the metadata of who is messaging whom from Signal's own service: messages carry only the destination on the outside, with the sender's identity encrypted, so the server delivers without observing the sender.

signal.org ↗

LAST REVIEWED 2026-08-04 · METHODOLOGY v1.7