Your own network. We hold nothing in it.
A ministry, a newsroom chain, an NGO federation, a hospital group: an organisation whose adversary is a state, or whose law requires that its communication never leave its own control, runs its own deployment of the open code, with its own keys and its own operators, on its own hardware. The company sells the software, the operator kit, support and the certifications the buyer requires. It never holds a key, a conversation or a record for any customer, a ministry included, which is the same property the consumer product rests on.
The buyer runs the code. The company never has a privileged door.
There is no hosted version of a sovereign deployment and there will not be one: a hosted version is a version the host can be compelled over. The buyer builds the apps from the published source with its own network profile, runs its own relays from the operator kit with its own directory keys, and its people pair, message, call and share exactly as on the public network. The company's part is the software, the recipe, the support, and the accreditation work the buyer's procurement requires. Lawful requests from any authority are answered by the company the way they are answered for the consumer product: with what exists, which by design is nothing.
Every address and root of trust a build pins is one file.
A build of the apps reaches for seven things: its home relay's onion and clear addresses, the directory's keys and threshold, the call relays, and the discovery pair. Since October 2026 they live in one profile file, generated into both apps, the engine and the page, with a guard that refuses a value pinned anywhere else. A sovereign deployment is a second profile in the buyer's fork, with its onion, its roster, its call relay and its discovery pair, and the same build. Nothing else in the tree knows the difference, and nothing about the protocol moves: the buyer's build is checked against the same published vectors as ours.
One file, four generated copies, a guard that refuses a second pin. Since 28 October 2026 a template for a buyer's own network sits beside the public profile, the generator writes a second network beside the tree without touching it, and a guard generates from the template on every run and holds the result to the public network's shape; the runbook for a whole deployment, step by step with each step's recipe and whether it has been rehearsed, is deploy/operator-kit/SOVEREIGN-DEPLOYMENT.md in the published source.
A sovereign network is an island. Its users want it so.
A phone on a sovereign network holds that network's directory keys and lists that network's relays. A link from the public network names a relay the phone's directory never vouched for, and the phone refuses it with a sentence; a ministry's phones cannot be pairable from the outside by a pasted link. If a buyer wants its island bridged to the public network, the honest shape is a directory that lists both sets of relays under both parties' keys, a decision between keyholders and a contract, and not a code path. The operators page says the same from the other side.
A buyer does not take our word. It takes the source, the vectors and the record.
The source is published under a licence that keeps it so. The protocol is specified construction by construction, with sixteen known-answer vectors computed by the shipping code, so a buyer's own build, or a buyer's own implementation, is checked byte for byte. Every push to the source carries a signed record in a chain, so a rewrite of history is visible. The reproducible build of the engine is proven on one machine and the build of the whole app is being measured, with each finding written down as it is found; the proof page is the page that invites you to check.
Defence communications are a separate line, and it is not built.
Tactical communication, bearers with no internet (mesh, satellite, radio), hardened handsets and the accreditations a defence procurement asks for are a line of their own. What exists today is the business track and a design note that keeps the engine from painting itself into a corner; the build comes after the consumer product is launched and audited, because a launched, audited product is what a tender is bought on. Nothing on this page claims otherwise.
The software exists. No deployment does.
The apps, the relay, the operator kit, the network profile and the vectors are published and tested; the Teams relay has run on two phones. No sovereign deployment exists, no accreditation has been sought, and which jurisdictions the company sells into is a decision that carries an invoice and sits with its founder, under EU export and sanctions law. An institution that wants to be the first writes to [email protected].