Frequently asked questions

Venoly is a security-first, real-time communication and community platform with text, voice, and video chat, communities ("servers"), and an AI character layer. It is free to use, independent, and privacy-respecting.

No. It shares the familiar community-app shape (servers, channels, roles, voice), but it is engineered security-first with original systems — most notably Venilator, a custom security-policy language compiled to bytecode and run on a sandboxed VM — plus an in-house defense suite and an AI character layer that do not exist on other chat platforms.

Security is its core differentiator. Multiple independent layers run by default, each on the traffic it guards: a policy VM (Venilator), behavioral anti-abuse (Aegis), login risk scoring at sign-in (Sentinel), a hash-chained audit ledger (Cipher), per-message provenance (Warden), honeytokens (Tripwire), encryption at rest (Vault), per-user rate limiting, and TOTP two-factor authentication.

It is free to use, and messaging, servers and calls will stay free. Optional plans (Spark, Premium, Aurora, Supernova, and group versions for up to five people) and server boosts add extras such as more storage, bigger uploads and longer messages. Nothing that is free today will be moved behind a paywall.

Any modern browser, a desktop app for Windows and Linux, and an Android app you download from venoly.nl/download (it is not on Google Play yet). On Mac, iPhone and iPad Venoly runs in the browser.

No. There are no tracking pixels, no third-party ad SDKs, and no analytics that follow users across the web. Sensitive data is encrypted at rest, and Venoly is built EU/GDPR-first.

Venilator is Venoly's in-house security-policy language. Policies are written in an indent-based DSL (".vnl"), compiled to bytecode, and evaluated deterministically by a sandboxed stack virtual machine on relevant requests, with block / throttle / warn / captcha actions. Communities can share and import policies through a policy marketplace.

Venoly encrypts data in transit (TLS) and encrypts sensitive data at rest (the Vault layer), and de-identifies stored data structurally. It does not use end-to-end encryption for messages, by design: the platform must be able to act on its trust & safety and legal obligations. We state this plainly rather than imply parity with end-to-end-encrypted apps.

The server stack is self-hostable. Self-hosting is an advanced path; a conceptual overview is published, and operator documentation is shared directly rather than posted publicly.

Yes. AI-driven characters backed by a model runtime appear as real members with presence and memory and can participate in conversation. AI participation is disclosed to users, and characters degrade gracefully (they go offline) if the model backend is unavailable.

No. Venoly's foundations date to 2015 as a business/enterprise-only communications platform. It was substantially rebuilt and relaunched as today's security-first community platform — so while the public venoly.nl site is recent, the project and team are not.

No. Venoly does not implement Chat Control and publicly opposes it. No classifier reads message text. The only text rules are spam heuristics and the word filters a server's own owner sets up for that server.

Email security@venoly.nl or use the responsible-disclosure / bug-bounty program at https://venoly.nl/legal/bounty, which includes safe-harbor terms. A published security contact is also available at /.well-known/security.txt (RFC 9116).