Signal does not have access to your social graph[1].

(Delta Chat markedly does leak your social graph, because it's email and email has no way to protect sender metadata from each user's email provider. That means full social graph recovery is one low-effort subpoena away in your attacker's municipality of choice.)

[1]: https://signal.org/blog/private-contact-discovery/

> Signal does not have access to your social graph

Their contact discovery uses SGX, which has a long list of vulnerabilities [1], and is even deprecated by Intel.

With access to the server, my guess is that getting someone's social graph is not entirely impossible.

[1]: https://en.wikipedia.org/wiki/Software_Guard_Extensions#List...