diff --git a/src/crypto/device.rs b/src/crypto/device.rs
index ad0ad82d..166c995e 100644
--- a/src/crypto/device.rs
+++ b/src/crypto/device.rs
@@ -159,15 +159,14 @@ impl Device {
 impl From<&OlmMachine> for Device {
     fn from(machine: &OlmMachine) -> Self {
         Device {
-            user_id: Arc::new(machine.user_id.clone()),
-            device_id: Arc::new(machine.device_id.clone()),
+            user_id: Arc::new(machine.user_id().clone()),
+            device_id: Arc::new(machine.device_id().clone()),
             algorithms: Arc::new(vec![
                 Algorithm::MegolmV1AesSha2,
                 Algorithm::OlmV1Curve25519AesSha2,
             ]),
             keys: Arc::new(
                 machine
-                    .account
                     .identity_keys()
                     .iter()
                     .map(|(key, value)| {
diff --git a/src/crypto/machine.rs b/src/crypto/machine.rs
index 545290ad..0a159587 100644
--- a/src/crypto/machine.rs
+++ b/src/crypto/machine.rs
@@ -22,8 +22,8 @@ use uuid::Uuid;
 
 use super::error::{OlmError, Result, SignatureError, VerificationResult};
 use super::olm::{
-    Account, GroupSessionKey, InboundGroupSession, OlmMessage, OlmUtility, OutboundGroupSession,
-    Session,
+    Account, GroupSessionKey, IdentityKeys, InboundGroupSession, OlmMessage, OlmUtility,
+    OutboundGroupSession, Session,
 };
 use super::store::memorystore::MemoryStore;
 #[cfg(feature = "sqlite-cryptostore")]
@@ -61,11 +61,11 @@ pub type OneTimeKeys = BTreeMap<AlgorithmAndDeviceId, OneTimeKey>;
 
 pub struct OlmMachine {
     /// The unique user id that owns this account.
-    pub(crate) user_id: UserId,
+    user_id: UserId,
     /// The unique device id of the device that holds this account.
-    pub(crate) device_id: DeviceId,
+    device_id: DeviceId,
     /// Our underlying Olm Account holding our identity keys.
-    pub(crate) account: Account,
+    account: Account,
     /// The number of signed one-time keys we have uploaded to the server. If
     /// this is None, no action will be taken. After a sync request the client
     /// needs to set this for us, depending on the count we will suggest the
@@ -147,6 +147,21 @@ impl OlmMachine {
         })
     }
 
+    /// The unique user id that owns this identity.
+    pub(crate) fn user_id(&self) -> &UserId {
+        &self.user_id
+    }
+
+    /// The unique device id of the device that holds this identity.
+    pub(crate) fn device_id(&self) -> &DeviceId {
+        &self.device_id
+    }
+
+    /// Get the public parts of the identity keys.
+    pub(crate) fn identity_keys(&self) -> &IdentityKeys {
+        self.account.identity_keys()
+    }
+
     /// Should account or one-time keys be uploaded to the server.
     pub async fn should_upload_keys(&self) -> bool {
         if !self.account.shared() {
@@ -1869,12 +1884,12 @@ mod test {
         let room_id = RoomId::try_from("!test:example.org").unwrap();
 
         let to_device_requests = alice
-            .share_group_session(&room_id, [bob.user_id.clone()].iter())
+            .share_group_session(&room_id, [bob.user_id().clone()].iter())
             .await
             .unwrap();
 
         let event = ToDeviceEncrypted {
-            sender: alice.user_id.clone(),
+            sender: alice.user_id().clone(),
             content: to_device_requests_to_content(to_device_requests),
         };
 
@@ -1890,7 +1905,7 @@ mod test {
             event_id: EventId::new("example.org").unwrap(),
             origin_server_ts: SystemTime::now(),
             room_id: Some(room_id.clone()),
-            sender: alice.user_id.clone(),
+            sender: alice.user_id().clone(),
             content: encrypted_content,
             unsigned: BTreeMap::new(),
         };
@@ -1907,7 +1922,7 @@ mod test {
             _ => panic!("Decrypted room event has the wrong type"),
         };
 
-        assert_eq!(&decrypted_event.sender, &alice.user_id);
+        assert_eq!(&decrypted_event.sender, alice.user_id());
         assert_eq!(&decrypted_event.room_id, &Some(room_id));
         assert_eq!(&decrypted_event.content, &content);
     }
diff --git a/src/crypto/olm.rs b/src/crypto/olm.rs
index 64e247af..76fba626 100644
--- a/src/crypto/olm.rs
+++ b/src/crypto/olm.rs
@@ -22,7 +22,8 @@ use serde::Serialize;
 use tokio::sync::Mutex;
 use zeroize::Zeroize;
 
-use olm_rs::account::{IdentityKeys, OlmAccount, OneTimeKeys};
+pub use olm_rs::account::IdentityKeys;
+use olm_rs::account::{OlmAccount, OneTimeKeys};
 use olm_rs::errors::{OlmAccountError, OlmGroupSessionError, OlmSessionError};
 use olm_rs::inbound_group_session::OlmInboundGroupSession;
 use olm_rs::outbound_group_session::OlmOutboundGroupSession;