Messages that reach who you sent them to, on infrastructure you run.

End-to-end encrypted chat and groups for an organisation, delivered by a relay the organisation operates itself. No provider, no account, no server of ours in the path.

What your relay can see

  • The address each device connects from
  • Which identity signed in, and when
  • Timing and volume of messages
  • Message size, to within a factor of four
  • Roughly how many contacts an identity has
We publish this list because you will be asked for it, and because a product that claims to hide everything is not telling you the truth.

What it cannot see

  • What any message says
  • Who sent a private message
  • Who it was sent to
  • Who talks to whom
  • That any set of messages forms a group
These hold against the relay operator, against a future quantum computer reading recorded traffic, and against anyone who takes the relay's disk.

The relay is a store, not a participant.

Every person is a keypair. Every message is a signed, sealed event. A relay holds those events and hands them to whoever proves they may receive them — and understands nothing else about them. The sender's identity is inside the encryption. The recipient is addressed by an opaque tag that changes every week. The relay matches the tag and moves on.

You run the relay. A Windows application, on a machine you own, under a jurisdiction you chose. It needs nothing from us to work, and if we disappeared tomorrow it would keep working.

To reach someone at another organisation, your device connects to their relay and drops the sealed message there. No account is needed, and the two relays never speak to each other. There is no federation to trust and no central server to depend on.

What it does

One-to-one chat

Sealed sender, hybrid post-quantum key agreement, and a verification step that grants a badge only when two people compare codes in person.

Groups

A message is encrypted once and delivered to each member separately, so the relay cannot tell the messages are related. Removing someone rotates the key.

Attachments to 256 MB

Chunked, encrypted, and held on the sender's relay. A relay holding every piece of a file holds nothing it can read.

What it does not do, and we say so

Removing someone from a group does not take back what they already have. They keep every message they received. Rotating the key stops them reading what comes next, and that is all any messenger can offer. The app says this at the moment you remove someone, because you will assume otherwise.

A seized phone is readable. Messages within the retention window are on the device. There is no ratchet yet; that is on the roadmap and it is not in the product today.

There is no account recovery. An identity is a key. Lose the key without a backup and it is gone, and there is nobody — including us — who can bring it back. The app makes you choose to skip the backup rather than letting you forget.

A relay knows its members are online. A mailbox has to know its owner. What it does not know is who they are talking to.

Where it stands

September 2026
Two people, two phones, two cities, one relay on a Windows machine behind a tunnel. Messages both ways, and a 256 MB file in each direction. The first things the product did outside a test rig.
v0.12.23
The protocol specification, with fourteen normative test vectors that the implementation reproduces byte for byte.
562 tests
Plus a scenario runner that drives the real binaries through a twenty-eight-step exchange and then searches the relay's log to prove no identity leaked into it.
80 findings
Places where implementing the specification found it wrong, each recorded with the reasoning that fixed it. We think a protocol whose defects are on the record is safer than one whose defects are not.

See it on two phones.

A demonstration is the relay on a laptop, the app on two handsets, and twenty minutes. You will see what the relay's console shows — and what it doesn't.

Write to info@nsango.com