It's pointless to say the least to claim "Private and secure" without at least having client-side AEAD of some sort.