Questions and answers

An end-to-end encrypted workspace: Mail, Pages for docs and wikis, Sheets for spreadsheets, Calendar, Drive, Tasks, Contacts, Video for calls and, for teams, Chat, on one account with one set of keys that only you hold.

Everything is locked on your device before it's sent to us, and we never get the key. Each item has its own key, so sharing one thing shares nothing else. How the encryption works explains it in plain words.

Less than most services, but not nothing: things like sizes, times, and who you share with. The transparency page lists it for every app.

On our servers in Germany and Finland, under European law. No US cloud sits between you and your data.

Any modern browser, and a Mac app. There are no apps for Windows, iOS or Android yet.

The code that encrypts your data is, under the MIT licence. See open source for what's public and what we're built on.

Not yet. An on-prem edition, the same stack we run, is planned for teams whose data can't leave the building. Join the on-prem waitlist.

Email hello@jellysuite.com.

Use the recovery key you got when you created your account. It's the only other way to unlock your data.

No. We never had what your password protects, so we can't unlock it. If you lose both your password and your recovery key, nobody can get your data back, including us.

Twelve words that belong to each account. Compare them with someone once, in person or on a call, and you know you're sharing with them and not someone pretending to be them.

Not yet. Your password never leaves your device, even when you log in.

Basic is €4 a month paid yearly, or €5 monthly. Plus is €7 per person a month yearly, or €9 monthly. See pricing.

No. You pay us, so we never need to make money from your data.

Pick a plan, pay, and create your account right after. There's no trial; as a consumer you can withdraw within 14 days.

10 GB on Basic, across Mail, Pages, Sheets and Drive. On Plus, the team shares 100 GB for each person in it; every member also has 10 GB of their own for mail and private files, and whoever holds the Plus plan has 100 GB.

Yes. A team gets one shared workspace for Pages, Sheets, Drive, Calendar, Tasks, Contacts and Chat. Admins create accounts at your own domain or invite people who already use jellysuite, put people in groups, and restrict a page, spreadsheet or folder to the people and groups listed on it. Your organisation can't read or recover anyone's account: each person keeps their own password and recovery key.

Yes. Add your domain, copy the DNS records the app shows you, and it checks them for you. Outgoing mail is signed with your domain's own DKIM key.

Yes, anyone with an email address. Mail from outside is encrypted the moment it arrives. Mail you send outside is read in our server's memory only while it's signed and handed on, then it's in the recipient's inbox under their provider's rules.

Mail between jellysuite accounts, and PGP mail with outside addresses, shows a lock. Other mail with outside addresses shows a shield instead.

Yes. Send later for scheduling, and undo for five seconds after you send.

Yes, by sender, recipients, subject and preview. Search runs on your device, so it doesn't cover full message bodies yet.

Yes. Every account gets a PGP key, or you can import your own. When someone outside jellysuite has a published key, mail to them is encrypted in your browser, and PGP mail they send you stays encrypted until you open it.

Not yet. Importing is on the way.

Not yet. They're on the way.

No. Mail is decrypted on your device, so you use the jellysuite apps.

Yes, with live cursors. Edits and cursors are encrypted, so we pass them along without reading them.

Yes. Put pages inside pages, as deep as you need.

Yes. Look through the last 50 versions of a page and restore any of them.

Yes, as a read-only link. The key is in the link itself, after the #, which browsers never send to us.

Not yet. They're on the way, along with offline editing.

All of them. Use it on your own in your personal workspace, or with your team in a team workspace.

Yes, .xlsx and .csv files, from your computer or from Jelly Drive with Open in Sheets. Your device reads the file: values, formulas, number formats, bold and colours, borders, merged cells, column widths, frozen rows, hidden rows and columns, conditional formats and charts come across. Before the spreadsheet is created, you see how much came over and a list of anything that didn't. A file from your computer never reaches us; one opened from Drive stays there as it is.

Pivot tables and Excel tables become plain cells, and array formulas and links to other workbooks keep their last values. Comments and notes, images, data validation, macros, sparklines, hyperlinks and protection aren't kept, and functions we don't have yet show #NAME?. Filters, row and column groups, named ranges and chart sheets aren't kept either. The import lists each of these, with examples of where they were.

Yes. Download it as an .xlsx file with every tab, or one tab as a .csv file, made on your device, for Excel, LibreOffice or any other spreadsheet app. You can also save an .xlsx copy to Jelly Drive, encrypted like any other file.

No. The title, cells, formulas, tab names, formatting, charts and even how many rows a sheet has are encrypted on your device, and the values are calculated there too. We can see that a spreadsheet exists and which folder it's in, who it's shared with, how big its encrypted document is and when it changes, and who has it open right now. A big spreadsheet is a bigger document, so its size gives a rough idea of how much is in it.

194 of Excel's functions, with Excel's results: maths and statistics (SUMIFS, COUNTIFS, AVERAGEIFS, MEDIAN, STDEV), logic (IF, IFS, IFERROR, SWITCH), lookups (XLOOKUP, VLOOKUP, INDEX and MATCH), text (TEXT, TEXTJOIN, SUBSTITUTE), dates (EOMONTH, NETWORKDAYS, DATEDIF) and finance (PMT, NPV, IRR). Array formulas that spill into other cells, LAMBDA and LET aren't supported.

Yes, live, with each person's selection on the grid under their name. One person can insert a row while another types below it: both edits survive and formulas keep pointing at the right cells. Sorting changes the sheet for everyone, with undo. Filters are your own, so filtering doesn't hide rows for anyone else.

Not yet. On a phone or a small tablet a spreadsheet opens read-only: you can scroll, switch tabs and tap a cell to see its formula.

Up to about 50,000 filled cells. The app warns you as a spreadsheet gets close, and won't paste or import more than fits.

No. Pivot tables, data validation and dropdowns, comments, protected ranges, named ranges, images in cells, macros and data pulled from the web aren't part of Jelly Sheets yet.

Not by email yet. You can export an event as an .ics file and send it to them. Invitations between jellysuite accounts work today, with private answers.

Yes. Export it as .ics and import it; the app shows what came over.

Yes, including moving or cancelling a single occurrence.

Yes, as browser or desktop notifications while the app is open. Reminders when it's closed are on the way.

Not yet.

All of them. Use it on your own in your personal workspace, or with your team in a team workspace.

No. Titles, notes, due dates, how a task repeats, priorities, labels, who's assigned and even how many tasks a project has are encrypted on your device. We can see that a project exists, who it's shared with, how big its encrypted document is and when it changes, and who has it open right now. A project with lots in it is a bigger document, so its size gives a rough idea of how much is there.

A title, plus any of: a date or time (“tomorrow 6pm”, “fri”, “in 3 days”), a repeat (“every 1st”, “every weekday”, “every 3rd friday”), #project, /section, +label, p1 to p4 and @person. Quick add understands English only for now.

Ticking one off records that it's done and moves it to its next date, counted from when it was due, and unticks its subtasks. A repeat can be daily or less often; tasks can't repeat every few hours.

Yes. Jelly Calendar has a Tasks layer you can turn on or off. Tasks with a date show at the top of the day, tasks with a time show at that time, and you can tick them off there.

Yes, anyone who can open the project. If they can't yet, the app offers to share the project with them first, and never shares it on its own. Assigned tasks show under Assigned to me, with a notification while the app is open.

Not yet. Notifications for due tasks and new assignments come while Jelly Tasks is open in your browser or desktop app.

Not yet. Today it's lists with sections. Time-blocking, comments and attachments on tasks aren't there either.

All of them. Every account has My contacts, an address book that's yours alone. Shared address books for a team, like Customers or Suppliers, come with the Plus plan.

Yes. Export them as a .vcf (vCard) file: Google Contacts has Export › vCard, Apple Contacts has File › Export › Export vCard, and Outlook can save contacts as vCard files (CSV files can't be imported yet). Open the file in Jelly Contacts and your device reads it, shows how many people it found and which ones you already have, and lets you add them as new cards, update the matches or skip them. The file never reaches us.

No. Names, emails, phone numbers, addresses, notes, photos, which card is linked to which Jelly account and even how many contacts a book has are encrypted on your device. We can see that an address book exists, who a team book is shared with, how big its encrypted document is and when it changes, and who has it open right now. When a linked card opens or @ suggests people, your device reads those Jelly accounts' public keys to check them, so we see which accounts it reads, not which card links them. A big book is a bigger document, so its size gives a rough idea of how much is in it.

That the card is linked to Anna's Jelly account. When an email on a card belongs to a Jelly account, the card offers to link it, and only does when you confirm. Once you've compared safety words with her, the card says Verified; if her key ever changes, it tells you, and Message and Share wait until you've checked. Checking an address shows us which address you looked up, just as writing to it does, so the app only checks when you ask it to, never for a whole import.

Not yet. There's no CardDAV sync, so contacts on your phone and in Jelly Contacts don't update each other. You can move them across with a .vcf file in either direction.

No. My contacts is private to you. To share contacts with colleagues, put them in a team address book, which can be shared with the whole team or restricted to a group.

No, never on its own. Import points out people you already have, and a card shows a hint when it looks like a duplicate. Merging two cards is your choice, with undo.

Not yet. A book is one list today, with Starred for the people you need most. Birthdays are saved on the card but don't show in Jelly Calendar.

Teams on the Plus plan. Chat lives in your team's workspace, so everyone in the team can use it. In a personal workspace the app asks you to create or switch to a team.

No. Messages, channel names and topics, reactions, mentions and file names are encrypted on your device before they reach us. The transparency page lists what we can see: who is in each channel, who posted each entry (reactions and pins included) and when, roughly how big it is, when a message was edited or deleted, whether it is a message, reply, reaction or pin, whether a thread reply was also shown in the channel, and each person's read position and mute and notification settings.

Public channels that anyone on the team can find and join, private channels for the people and groups you pick, and direct messages with one to seven other people.

Yes. Whoever joins a channel, or is added to a private one, can read its whole history. If you need a conversation that newcomers can't read back, start a new channel.

The channel gets a new key. The person can't read anything posted after that. What they had already seen is still on their device, as with any encrypted chat.

Your device builds the search index from the messages it has loaded and keeps it encrypted on the device. Searches never leave it. History loads in the background, and search tells you when older messages of a channel haven't been loaded yet.

It can't change what a message says or who wrote it: every message is signed by its author, and your app sets aside anything whose signature doesn't check out. The bookkeeping around messages isn't signed, though. A misbehaving server could change their order, show a message as deleted, hide a reaction or serve back an older copy of a message you edited. And someone who has left a channel could, with the server's help, add messages under their own name as if sent while they were still in it.

Yes. Start a huddle from any channel or direct message and the people in it can join with one click. Huddles are end-to-end encrypted Jelly Video calls.

Not yet. Jelly Chat is for the people in your team, in the browser.

All of them. Meeting rooms and Jelly Video on Calendar events come with every plan. Huddles live in Jelly Chat, so they come with the Plus plan.

Yes, always. Sound, video, shared screens, the in-call chat, reactions and raised hands are encrypted in your browser. Each call has its own key, sealed with the key of the channel, event or meeting room it belongs to; our servers store it sealed and hand it only to the people in the call. Our media server passes the encrypted data from one person to the others and can't open it. There's no setting to turn this off. Everyone with access to that channel, event or meeting room holds the key that could open a call's key, so who gets into a call, and who is handed its key, is enforced by our servers.

Current versions of Chrome, Edge, Safari and Firefox, on a computer or a phone. A browser that can't encrypt calls can't join: the app says so before you enter, and there is no unencrypted fallback.

Up to 50. You can join the same call from up to four of your own devices.

Not yet. Everyone in a call has a jellysuite account, and can only join a call in a channel, event or meeting room that's shared with them. A meeting link works only for those people. Guests need a way to prove who they are that we haven't built.

No. To record or transcribe a call, something other than the people in it would have to see and hear it. On our servers that would mean giving them the key, which is exactly what end-to-end encryption rules out. There are no live captions either.

Which channel, meeting room or event has a call going on, who joins and leaves and when, from how many devices, and how long it lasts. During the call the media server also sees whose microphone, camera or screen share is on, how much data each sends, who is speaking, your IP address, and when a host mutes or removes someone, locks the call or ends it. It never gets the sound, the picture, a shared screen, the chat, reactions, raised hands or the meeting's title. The transparency page has the full list.

Each person's device signs in to the call with their own key, inside the encrypted channel. A name is shown only when that signature checks out against a key your device already trusts. A guest you've never met is shown by @handle when the person who invited them vouches for them, for that call only, and the call's details list says who vouched. Anyone else shows as an unverified participant, with a warning. There is one limit: the sound and picture themselves are encrypted with keys everyone in the call can work out, so a person in the call working together with our media server could pass off their own sound or picture as another participant's. Our servers alone can't, and neither can someone outside the call.

Starting a huddle in a direct message, or a meeting shared with up to eight people, rings them for 30 seconds. A conversation you muted doesn't ring. Who is calling is our server's word until you're in the call, so when you accept, your microphone stays off until the person calling has proved who they are with a key your device already trusts. Someone else vouching for them isn't enough for that. If it doesn't happen within a few seconds, the microphone stays off and the app says so.

They're dropped and can't come back while the call lasts. Our servers stop handing them keys and the call moves to a new key. That part is enforced by our servers, not by the encryption: the removed person still holds the key of the channel, event or meeting room, which is what a call's key is sealed with. Their media server pass is good for up to 6 hours and can't be withdrawn, so their device may reconnect for a few seconds before it is dropped again, each time it tries; whatever passes in that time is encrypted. If you want someone out for good, remove them from the channel, event or meeting room: that gets a new key they can't open.

In a meeting, no: only the people in the call at that moment see a message, and nothing is kept when it ends. In a huddle, the notes are posted to the channel as a thread, encrypted like any other chat message.

No. Backgrounds, phone dial-in, breakout rooms, waiting rooms and mobile apps aren't part of Jelly Video. It does work in a phone's browser.

Photos, PDFs, audio, video, and text or code files up to 1 MB, all decrypted in your browser.

The key is in the link after the #, so whoever has the link can open the file or folder, and we can't. Links can let people view or edit, and you can turn them off anytime.

No. Names, contents, file types and thumbnails are all encrypted.

Not yet. File versions and folder uploads are on the way.