Why Europe's governments are moving their chats to Matrix

When the pandemic sent Luxembourg's civil servants home in 2020, a lot of official chatter ended up on American messaging apps, Cybernews reports, citing Computer Weekly. Six years on, the Grand Duchy has its own messenger, Luxchat. Why would a country of roughly 700,000 people run its own chat service? And is a government app actually safer than WhatsApp?

On Monday we mapped the main encryption protocols. Today we zoom in on one of them, Matrix, because it has quietly become the default choice for European governments that want their chats back under their own roof. We'll also look at what "sovereign" does and doesn't buy you, and at this year's public fight over Matrix's crypto library.

#What happened: the government messenger wave

Luxembourg. Luxchat runs on the open Matrix protocol, on servers in Luxembourg. Cybernews says the Ministry for Digitalisation built it together with the national internet exchange LU-CIX. Who actually operates it depends on the version. According to the official Luxchat site, the free public app and the paid business tier, Luxchat4Pro, are run and paid for by a group of private Luxembourg companies with backing from the Chamber of Commerce, and you pick one of those providers when you sign up. Luxchat4Gov, the version for public-sector staff, is provided by the State. Per Cybernews (October 26, 2026), Luxchat had about 14,000 users across schools, national government and municipalities, with apps for phones, desktops and the web. The plan is to let citizens handle things like parking permits or doctor consultations through it eventually.

The Luxchat site says messages and one-to-one calls are end-to-end encrypted, and that users of all three versions can message each other. One caveat it states itself: video conferences with three or more people are encrypted in transit only, not end to end. We found no published security audit on the site.

Elsewhere in Europe, the pattern repeats:

• France: Tchap, run by the interministerial digital agency DINUM, is Matrix-based. A Prime Minister's circular of July 25, 2025 asked for it to be rolled out widely across the public sector by September 1, 2025. Tchap says it had close to 300,000 monthly active users in 2025.
• Germany: the armed forces use BwMessenger, which its operator BWI says is built on Matrix; Cybernews dates the switch to 2020. In healthcare, the Matrix-based TI-Messenger is spreading, including to Austria.
• Poland: about 5,000 public-sector staff are testing a state messenger called mSzyfr, running on servers in Poland and offering end-to-end encryption, per Cybernews citing TVP World. That report doesn't say which protocol it uses.
• The European Commission is moving staff off WhatsApp for internal communication by the end of 2026, Cybernews reports.

At the Matrix Conference 2026 in Malmö, the Foundation counted over 340 people and 70 talks, with civil servants from 15 nations and intergovernmental bodies, including Germany's FITKO, Sweden's Försäkringskassan, France's DINUM, Luxembourg, the UN's computing center UNICC and NATO. Matrix.org's recap credits Jens-Uwe Thieme, speaking in a TI-Messenger talk, with the point that digital sovereignty has stopped being a talking point and become a requirement in how public bodies buy software. Keep in mind that the write-up comes from the Foundation itself, so it's an advocate's account.

The EU paper trail is more cautious than the hype. The Commission's February 2025 proposal for a cyber crisis blueprint said Union-level actors "should use solutions based on the Matrix protocol for real-time communication." The version the Council adopted in June 2025 drops the name and asks for solutions "based on open protocol with open-source implementations suitable for real-time communication, managed by an EU-resident entity," with the Commission due to propose a set of tools by the end of 2026.

#Why it matters: what federation gives you

Three terms do most of the work here. A homeserver stores your account and your rooms. A client is the app you type into. Federation means homeservers talk to each other over the open protocol, so a room can include people on many servers.

For governments, that's the attraction. Each ministry or country can run its own server, inside its own borders and under its own rules, choose its own app and still chat with partners. At the conference, Matrix.org showed people from Swedish and French agencies, the European Commission and NATO talking across separate servers and different clients, under a slogan that paired sovereignty with staying connected.

Compare the walled-garden model: one company runs the servers, writes the only app and sets the terms. That's simpler to secure, because there's one codebase and one operator. Federation trades that simplicity for control. More operators and more client apps mean more software to patch and more places where something can be misconfigured.

Content stays private between servers thanks to the encryption we covered on Monday: Olm sets up encrypted device-to-device channels, and Megolm keys protect messages in rooms.

#What "sovereign" doesn't buy you

Sovereign isn't a synonym for secure. Hosting at home answers who controls the servers and the data. It doesn't automatically answer how strong the protection is.

• The operator sees a lot. In Matrix, end-to-end encryption covers message content, but the homeserver still knows who is in which room, when people are active and which devices they use. On a government server, that operator is the government.
• Defaults matter. Encryption quality depends on the client and the library it ships, and on what's turned on by default. Luxchat's own exception for group video calls is a good example.
• Audits matter. Citizens can reasonably ask whether a national app has been independently tested and whether the results are public. Tchap says its end-to-end encryption has been validated by independent audits; for Luxchat we couldn't find that stated.

So a government app isn't automatically more or less secure than WhatsApp or Signal. It mainly changes who's in charge, which is a big deal for states and a smaller one for most individuals.

#The technical bit: the vodozemac dispute

Matrix's main crypto library is vodozemac, written in Rust. In February 2026 it became the center of a very public disagreement, and the episode is a useful lesson in how open cryptography gets checked.

The core issue in plain words. Diffie-Hellman lets two devices derive a shared secret. But if one side deliberately uses a broken key (here, a specially chosen value that forces the result to all zeros), the "shared secret" becomes something anyone can predict. Good implementations reject that case. vodozemac's Olm code didn't.

The report. On February 17, the researcher Soatok published a post describing the missing all-zero check, possible downgrades from a newer Olm version to the older one, and several smaller issues. By his own timeline, he contacted Matrix on February 11 and went public six days later. In Matrix.org's view, that came before the two sides had finished discussing the technical details.

Matrix.org's reply. The next day, the Foundation published its analysis. It agreed the check was missing but disputed the impact: Olm identity keys carry a signature from the device's own Ed25519 key, so someone on the network can't slip in a broken key. "Olm v2" isn't specified or deployed, it argued, so a downgrade from it isn't a live problem, and the short 64-bit message tags are a known trade-off. Its conclusion was that, in the Foundation's view, none of the reported issues could be exploited in practice. It promised the check as defense in depth anyway, and said it regretted that the findings went public before the discussion had concluded.

A code-level fact check. In May, the Berlin IT firm KSOL, which runs a homeserver, compared the claims against the code. Its verdict: the all-zero issue was real and was fixed in commit 59800c8 on February 12; strict Ed25519 signature checks were off by default and were switched on in a March 25 commit; the claimed "silent truncation" downgrade didn't hold up, because the code returns an error. Several other items were deliberate choices kept for compatibility with the older library. KSOL also pushed back on Matrix.org: signatures stop an outsider, but a malicious participant could sign up a device whose key is all zeros, and then room keys sent to that device over Olm could be recovered by the homeserver operator. Note that KSOL's author says they aren't a cryptographer and used an AI assistant for the code review.

Where it landed. The fixes shipped together in vodozemac 0.10.0 on April 13, 2026, which rejects the all-zero result, makes strict signature checks the default and moves the experimental newer Olm version behind a feature flag. CyberInsider covered the spat as it unfolded.

The upside: in an open system, outsiders can find bugs, and other outsiders can check both the bug report and the rebuttal. The messy part: disclosure timing and severity claims became a fight of their own.

#Matrix 2.0 and the money problem

Around the conference, the Spec Core Team accepted almost all of the Matrix 2.0 spec change proposals (MSCs). According to This Week in Matrix, only MSC4480 and MSC4075 still need work before Matrix 2.0 follows. The current stable spec is still a 1.x release (v1.19 when we checked). Matrix 2.0 bundles faster syncing so apps open instantly, login via the open OpenID Connect standard, built-in calls (MatrixRTC) and "invisible crypto," which aims to make encryption work without users fiddling with device verification.

Then there's funding. The Foundation's acting managing director, Amandine, made the point at the conference that Matrix costs nothing to use but real money to keep running. The Foundation's pitch is that if 80% of public bodies and companies running on Matrix joined at its lowest paid tier, Silver, its independence would be secured. There's a certain irony here: governments chasing sovereignty are leaning on a small non-profit's budget.

#What to look at in a government messenger

"Sovereign" describes where a system runs and who controls it. How private it is comes down to a few separate questions. The first is who operates the server: on federated Matrix, the homeserver operator sees room membership and timing even when content is encrypted, so a state-run server puts that metadata with the state, while Luxchat's consumer and business tiers are run by private Luxembourg firms. The second is default coverage, meaning which chats and calls are end-to-end encrypted out of the box and which aren't. Luxchat, for example, encrypts messages and one-to-one calls, but describes its video conferences of three or more people as encrypted in transit only. The third is whether independent audits are published, and Luxchat's site mentions none. Software versions are part of the picture too: vodozemac 0.10.0, released on April 13, 2026, is the release that carries the fixes for the confirmed issues, so deployments on earlier versions don't have them.

Run a Matrix server for an organization? Tell us what keeps you up at night.

Friday: can a Matrix app, WhatsApp and your iPhone ever talk to each other without losing encryption? The EU says they at least have to try. For the basics behind all of this, see our end-to-end encryption primer.