In development, not yet available

The Enterprise edition is not on sale today. This page describes the architecture we are building towards. Part of it is already written and tested, but no customer deployment has happened yet, and we do not sell something that does not exist.

What works today: end-to-end encrypted messaging, audio calls, and the security audit described on the Security page. What is left: the modules that connect Crypto to your IT systems (single sign-on, automatic account creation, audit log, server redundancy) are written, but they have never been plugged into a real corporate directory. And the relay network is still too small to hide who is talking to whom: today, messages pass through a mailbox, and whoever runs that mailbox can see which IP addresses are exchanging. The content itself stays encrypted. See the threat model.

We are looking for three pilot organisations to put the product through real conditions, with hands-on support. If that speaks to you, get in touch. We will tell you plainly whether Crypto meets your need today, or not yet.

Enterprise

Integrates with your tools. Runs on your servers. Entirely.

Crypto does not run on our servers, you install it on yours. Directory, relays, mailboxes and audio servers all run on your machines, operated by your teams, under your procedures.

Integration with your information system

Single sign-on (SSO)

People sign in with the account they already have in your organisation. Your password, multi-factor and session rules keep applying.

Account creation (SCIM)

Accounts and groups come from your directory. A joiner gets an account, a leaver is disabled, with no manual step.

Audit log

Administrative actions are recorded for your reviews and investigations: a device added, an access withdrawn, a configuration changed. Conversation content is recorded nowhere. The architecture does not allow it.

Sealed licences

Each licence carries a signature the software checks without a network. No activation server to reach, nothing reported back to us.

High availability

Server components deploy in several copies. If one goes down, another takes over automatically, with no intervention. Maintenance is scheduled, failure is absorbed.

Sovereignty: everything runs at your site

Client and servers are written in Rust, with no dependency on an outside service. The whole set installs onto infrastructure you control, including a network with no connection to the internet at all.

What runs on your infrastructure

directory authority: signs the list of approved relays; adding one takes the agreement of several authorities, not just one
transport relays: move messages from one machine to the next, including from a connection with no public address and no open port
mailboxes: hold encrypted messages while the recipient is offline, then hand them over
call servers: carry the audio when two machines cannot reach each other directly, two servers per call
desktop clients: Windows · macOS · Linux

What passes through our servers: nothing. No message, no record of who talks to whom, no log, no usage statistics.

The Gotham network (protocol, relays, directory, authority) is published under a free-software licence, the AGPLv3: your auditors can read and rebuild the code that carries your messages themselves. The client application stays proprietary and is audited under NDA. We would rather say it that way than let you believe everything is open.

Pricing

Pricing to be set with the pilot organisations.

A deployment on your own infrastructure has to be sized: number of sites, network topology, availability requirements, support. Describe your context and an engineer replies. Not an automated e-mail sequence.

Become a pilot organisation

The network is free and open (AGPLv3): evaluate it without talking to us, if you prefer. Downloads →