Ah so another day of sales falsely advertising something as "end to end encrypted" when they have no effing clue how it works.
However then for the devs... HTTP still? How did that happen? I'm usually very forgiving for engineers (I am one, why I'm salty about sales), but these are pretty jr level issues. Unless... the offshored it or only hired jrs then I completely see how it happened.
It could be. It could also be a bunch of cheaper junior devs who have never done devops. I've had to teach a lot of fresh engineers about devops because while they can code, they've never had to deploy a service before.
Apparently worse than I originally thought from what I understand now they logged every message sent and kept all files accessible including documents, photos, videos etc.