Right from the start we have wanted to do a freemium model. Just wondering how we protect IP when the code is open-sourced especially when all the encryption is

Right from the start we have wanted to do a freemium model. Just wondering how we protect IP when the code is open-sourced especially when all the encryption is done on the client side. Also, is it a standard for security apps to be all open-source? For example WhatsApp messenger claims to do end-to-end encryption but they haven't open-sourced their software. Also, Last-Pass has a free version too but they have not open-sourced their code. Is open-source the only way to help users believe in the app? I know for highly technical users it may help. But for an average user who is non-technical and wants to use the app, would they even understand what open-source is? I personally don't think not having an open-source code base delegitimizes the app but happy to see what everyone else thinks.