One network. Six doors.
The same relays, the same identity and the same protocol serve a person with a phone, a company with its own machines, a ministry with its own keys, an operator in another jurisdiction, a developer with a bot, and an auditor with a question. What each one gets, and what each one is told honestly about where it stands today.
A messenger with no number, for anyone whose adversary is bigger than a company.
Create an identity in seconds, with no number, no email and no account. Talk, call, share, in groups and channels, over Tor built into the app, with servers that keep no record of who you talked to. Behind your passphrase your messages, contacts and keys are sealed. Free, with cover traffic free, because privacy is never sold here. Pre-release today; the features page says what runs on each phone and the limits page says what does not yet.
Your own relay for your own people, which still cannot read them.
Run the published relay on your machines, in your jurisdiction, and reserve it for your people with seats you issue blind: the relay tells a seat holder from anyone else without learning which. You control the machine and still cannot read a word, and you can say so to your people and to anyone who asks. Built and run on two phones; not yet sold. Teams.
Your own network, on your keys and your hardware. We hold nothing in it.
A sovereign deployment is the open code run by you: your relays from the operator kit, your directory keys, your build from one profile file, your people pairing and talking exactly as on the public network, and an island by design. The company sells the software, the kit, support and the accreditation work; it never holds a key, a conversation or a record for any customer. No deployment exists yet, and which jurisdictions are sold into is a decision that sits with the founder under EU law. Sovereign deployments.
Run a relay. Hold nothing. Be the second operator the network needs.
The network is designed to be run by several operators under one signed directory, so that no single one holds both legs of a conversation. The kit is the deploy recipe, the memory-only posture, the undertakings and an outline of the agreement; what you see is one sentence long and what you cannot be made to produce is everything else. None has signed yet. The operator kit.
Bots, cards, identity as an API, and a protocol pinned by vectors.
A contact can be a program through the headless client; a program can send cards the app draws with its own code; an account can prove itself to your service with a statement your code verifies from the bytes; and the protocol under all of it is specified and pinned by sixteen vectors computed by the shipping code. No account with us, because there are none. Developers · The protocol.
The record, with dates, and a way to prove us wrong.
The source, the specification, the vectors, the signed push record, the audits with their counts, the threat model with the section titled "where we are weaker than Signal", the limits and the refusals: all public, all dated. The proof page invites you to check the binary in your hand; the research page is the record; the brand page has the marks and the words for a story. We will name an external auditor when there is one.