# End-to-End Encryption

End-to-end encryption (E2EE) adds an extra layer of security by encrypting the data transmitted between the server and client. The process begins with a key exchange; the client and server share keys for encrypting and decrypting messages. This exchange ensures all later communications are encrypted. Only the intended server and client can decrypt the messages.

***

## Security

The Incode Android SDK uses CryptoKit for all cryptographic operations:

- RSA-OAEP with SHA-256 asymmetric encryption for secure key exchange
- AES-GCM symmetric encryption for securing server requests and responses

***

## Enable End-to-End Encryption

Complete the following steps in order.

### Set Up a Custom Server for E2EE

Initialize the Welcome SDK with a custom server for E2EE, supplying the `E2EE_URL`:

```kotlin
IncodeWelcome.Builder(this, WELCOME_API_URL, WELCOME_API_KEY, E2EE_URL)
    .build()
```
```java
new IncodeWelcome.Builder(this, WELCOME_API_URL, WELCOME_API_KEY, E2EE_URL)
    .build();
```

### Enable E2EE via SessionConfig

Turn on E2EE when building your `SessionConfig`:

```kotlin
val sessionConfig: SessionConfig = SessionConfig.Builder()
    .setE2eEncryptionEnabled(true)
    .build()
```
```java
SessionConfig sessionConfig = new SessionConfig.Builder()
    .setE2eEncryptionEnabled(true)
    .build();
```

### Start Onboarding

Pass the `SessionConfig` to [startOnboarding](https://developer.incode.com/update/docs/android-configure-flows-locally-and-run-end-to-end), [setupOnboardingSession](https://developer.incode.com/update/docs/android-configure-flows-locally-and-run-step-by-step), [startFlow](https://developer.incode.com/update/docs/android-run-flows-configured-online), or [startWorkflow](https://developer.incode.com/update/docs/android-run-flows-configured-online), depending on your integration approach.

<br />