Solutions · 03
Keep the company's conversations the company's.
Post-quantum keys on every session, owner-signed control over every room, and a relay that cannot read what your teams say.
01 / THREE DAYS — THE ONES YOU PLAN FOR
Plan for the three days you hope never come.
-
DAY 1
Q-RATCHET
A laptop bag is left in a taxi.
Q-Ratchet already advanced past every delivered message: a key recovered from the lost device opens nothing that came before it, and the conversation heals forward.
-
DAY 2
ML-DSA-87
Someone senior leaves on bad terms.
Group authority is owner-signed cryptography, not a database row. Roles change by signature; the departed account keeps no silent reach into the room.
-
DAY 3
CARRIER MODEL
A records demand names your whole team.
The relay yields sealed ciphertext and opaque routing identifiers. Undelivered messages, group messages sealed to each member, and messages read without a receipt queue with routing metadata under a published retention ladder — bounded and expiring. Each photo, video or file your people send is held too, sealed, with an upload record that names the account that sent it, for up to 45 days after upload.
Shorten the compliance conversation to one sentence
Your reviewers do not need to trust adjectives. Every claim on this page anchors to the security overview and the evidence in the Trust Center — primitives named, deviations documented, caveats included.
Plan to run the relay on your own hardware
Self-hosting is in development: the relay never needs plaintext, so operating it will grant no one the power to read. Where the public path stands: self-hosting docs.
05 / THE HARD QUESTIONS
Ask the four your counsel will ask.
Do you sell data, run advertising, or mine analytics?
No. There is no advertising, no data sale, and no telemetry product — the relay holds ciphertext it cannot read, so there is nothing to mine.
Is there a separate admin console?
No. Administration happens inside the app through owner-signed group roles — authority lives in signatures your people hold, not in a web panel someone else could reach. A dedicated account area is on the roadmap; we will state exactly what it can and cannot see when it arrives.
What about multiple devices per person?
One device per identity at first — stated plainly. Linked devices are on the roadmap; the carrier model makes them harder to build than a server-copy design, and we will not weaken the relay to ship them faster.
What does a legal order against our workspace yield?
Sealed ciphertext and opaque routing identifiers; for undelivered messages, a group message sealed to each member, and a message read with Stealth Mode on or read receipts off, routing metadata under a published retention ladder, to a 30-day horizon; and each photo, video, file or group voice note your people send, sealed, with an upload record that names the account that sent it, for up to 45 days after upload unless its sender deletes it sooner. Group names, rosters as your people see them, and every word remain end-to-end encrypted.
Your conversations are an asset. Hold them.
Maximum crypto for every person, from the first.