Security is about verifiability. If you can't verify it's secure, it's not trustworthy. I've been looking into secure communication stuff for almost ten years now, and there's a low bar that makes it easy to inspect whether the app developers are even trying.

You want security for two things: Metadata and content.

Content privacy is done with end-to-end encryption. You ask yourself

1) Can I find public key fingerprints from the app? If this is not available, the app is not end-to-end encrypted properly, and you should immediately abandon it.

2) If the app is end-to-end encrypted, can I inspect the source code to verify end-to-end encryption is implemented properly? If you can't do that, i.e. if the source code is not available, there's no way to trust the app. If you lack skills needed to do that, you can pitch into an audit by third party.

3) If the source is open, can I verify I'm using binary compiled from said source? I.e., does the client have reproducible builds.

If all these three are true, then you can be sure it offers quite strong protection for your content.

This is true for e.g. Signal.

Regarding your Sagan Standard, the extraordinary claim is not

"It has a backdoor because we can't check."

The extraordinary claim is

"It doesn't have a backdoor, it's secure, but no, you can't check that for yourself."

At that point you need to have extraordinary proof that can verify the security. There's no pro-security argument in keeping an app proprietary, only monetary.

---

Next, metadata:

You ask yourself

1) Can I register the service anonymously, i.e. without giving any of my details

2) Can I connect (both register and use the app) via Tor? If not, your IP reveals your identity.

3) Who's hosting the service? Does a third party learn how often UID #4346455432 sends messages to other parties. I.e. is the app peer-to-peer. If the app is not peer-to-peer, your peers' bad OPSEC might deanonymize you if server-side data is cross-compared with an other social graph.

4) Can I misconfigure the system and lose anonymity (i.e. is the system Tor-routed by design or can you accidentally connect without Tor), and can you accidentally turn off end-to-end encryption and say something that might deanonymize you to the server?

ToTok is not open source, it doesn't have public key fingerprints, and judging by the completely novice, non-technical name-dropping of a few primitives in their PR statement (https://totok.ai/news):

"Furthermore, we equipped ToTok with such high-security standards as AES256, TLS/SSL, RSA and SHA256, to diligently protect the user data. We also implemented a privacy framework that complies with the local and international legal requirements to safeguard our users at all times."

It's trivial to implement backdoored system with said primitives: TLS is encryption that uses AES256, RSA, and SHA256, and it's only encryption between user and server, so server has access to plaintext data which can be given to the secret police etc. Even if they say they don't comply they might a) lie or b) be hacked.

The only way to protect from that is to always use E2EE, something ToTok does not do. So no, there's no reason to trust them. They haven't even attempted to deploy E2EE or anonymity for their system. Even if they're not intentionally being evil, they're being ignorant about security and thus, ignorant about the human lives affected.