Encrypt everything what you can.
For a communication you may use existing tools like WebRTC that allows to make live audio calls by. It tries to establish a direct connection or with a fallback to TURN retranslator inserver if both peers are behind NAT. The WebRTC already has an encryption built-in. It also supportsupports Data channelsChannels that may be used for a plain chat.
As an alternative you may use XMPP over WebSockets or HTTP Long Pooling (BOSH). You You may find ready to use libraries (strophe.js lib, Converse.js web app) and servers (Openfire, Prosody).