MTB Secure Connect

Choose a room

Messages are encrypted in your browser before being stored in D1. Use a strong, unique room passphrase.

Room passphrase

Phone numbers and notes in this directory are NOT end-to-end encrypted. Do not add real client data until security review.

Admin-only authentication uses PBKDF2 password verification and signed HttpOnly session cookies.
Messages use browser-side AES-256-GCM with PBKDF2 room passphrases; D1 stores ciphertext.
This is NOT Signal/Matrix-grade multi-device end-to-end messaging.
No SMS provider, inbound SMS, client accounts, MFA, rate limiting, passphrase recovery or security audit yet.
Not ready for real client tax, payroll, identity or banking information.