Indian WhatsApp alternative for organisations
SANKET (Sanket.Chat) by Tosh Defence is the made in India messaging platform built for organisations: Signal Protocol with post-quantum PQXDH and SPQR, AES-256 everywhere, and a dedicated installation on infrastructure the organisation owns, from any cloud it chooses to a fully air-gapped network. It is the Indian WhatsApp alternative for teams that need control as well as privacy, and a strong Arattai alternative or Sandes alternative wherever an organisation wants to run its own platform.
Why sovereignty matters for an Indian organisation
Encryption answers whether an outsider on the network can read a message. Sovereignty answers who owns the servers, the keys, the identities and the audit trail, and who decides when the software changes. SANKET answers both inside the organisation's own security boundary.
Jurisdiction
Which government can compel a provider to hand over data, change the software or stop the service? With SANKET, the installation sits in the jurisdiction the organisation chooses.
Ownership
The organisation owns the infrastructure, the identities, the policies and the hash-chained audit trail. Keys are generated on users' devices and protected by hardware-backed storage.
Operational independence
No vendor-operated service sits in the message path, and SANKET applications carry no third-party analytics or crash-reporting SDK.
Disconnected operation
SANKET runs on a closed or air-gapped network with an internal certificate authority, offline licences and signed offline updates.
Update control
Signed releases with freeze and rollback protection, installed when the organisation decides, online or from a signed offline package.
Built in India
Designed, built and supported in India by Tosh Defence, for Indian organisations and for sovereign nations.
SANKET vs Arattai vs Sandes vs WhatsApp
| Criterion | SANKET | Arattai | Sandes | |
|---|---|---|---|---|
| Who controls the infrastructure | The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path. | Zoho operates the service. | The Government of India: hosted by the government on government infrastructure. | Meta operates the service. |
| Deployment options | Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery. | Zoho-operated service; user data stored on servers located in India (App Store listing). | Government-hosted, cloud-enabled platform. Deployment by an organisation on its own infrastructure: not publicly documented. | Meta-operated service only. |
| Encryption protocol | Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only. | Not publicly documented | Not publicly documented | Signal Protocol, with Sender Keys for groups and SRTP for calls. |
| Post-quantum protection | Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge. | Not publicly documented | Not publicly documented | Not publicly documented |
| Groups and calls end-to-end encrypted by default | Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM. | Direct chats end-to-end encrypted (mandatory since November 2025); voice and video calls end-to-end encrypted; group encryption announced September 2026, default status not publicly documented. | Messages, audio and video calls and file exchanges end-to-end encrypted; groups end-to-end encrypted. | Yes: messages, voice and video calls and media end-to-end encrypted by default. |
| Customer identity provider (SSO / LDAP) | Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators. | Not publicly documented | Integrations with NIC email, DigiLocker and e-Office. Organisation's own SSO or LDAP: not publicly documented. | Not publicly documented |
| Admin controls and device governance | Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM. | Not publicly documented | Admin-based user management on the Sandes portal. | Not publicly documented |
| Data sovereignty (jurisdiction, built in India) | Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products. | Built by Zoho, headquartered in Chennai, India; user data stored in India. | Built and operated by NIC, Government of India. | Meta Platforms, USA. |
| Platforms | Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack. | Android, iOS, desktop, web and tablet; up to five devices. | Android, iOS and web. | Android, iOS, desktop and web (companion devices). |
Frequently asked questions
What is the best Indian WhatsApp alternative for organisations?
SANKET (Sanket.Chat) by Tosh Defence. It is made in India and gives an organisation familiar messaging, groups, files and calls with Signal Protocol and post-quantum protection, on infrastructure it owns and controls.
Is SANKET a made in India messaging app?
Yes. SANKET is designed, built and supported in India by Tosh Defence, headquartered in Gurgaon, Haryana. The free Sanket.Chat app is on iOS and Android, and organisations deploy Sanket.Work or Sanket.Enterprise.
How is SANKET different from Arattai and Sandes?
All three are Indian. Arattai is Zoho's messaging app for everyday conversations, and Sandes is the Government of India's platform hosted by NIC. SANKET is a platform any organisation runs as its own dedicated installation, with its own identity provider, policies and update timing.
Can an Indian organisation keep all its data in India with SANKET?
Yes. The organisation chooses where its installation runs, including its own premises, an Indian data centre or a fully air-gapped network, and the data stays there.
Does SANKET use end-to-end encryption?
Yes, always. Messages, groups, reactions, encrypted broadcasts, files and calls are end-to-end encrypted through Signal's official libsignal with post-quantum PQXDH and SPQR, and the server relays ciphertext without ever holding the keys.
Sources
- SANKET Technical Security & Architecture Whitepaper, public edition 2.0 (7 October 2026)
- Arattai official website
- Arattai on the Apple App Store
- Zoho: About us
- Outlook Money: Arattai rolls out end-to-end encryption for direct chats (19 November 2025)
- Storyboard18: Arattai rolls out end-to-end encryption for group chats (25 September 2026)
- SFLC.in: Security and privacy features analysis of messaging applications (12 October 2025)
- Sandes portal
- Business Today: Govt launches instant messaging platform Sandes (30 July 2021)
- Wikipedia: Sandes (software)
- WhatsApp Encryption Overview, technical white paper, version 9 (25 February 2026)
- Smartprix: WhatsApp usernames are here
Sources checked on 7 October 2026. Competitor facts are taken only from the sources listed. Where no public source was found, the cell reads 'Not publicly documented'. Product and company names are trademarks of their respective owners.
Put your communications under your own control
Talk to the Tosh Defence team about your deployment, from a dedicated cloud installation to a fully air-gapped estate, or read the full security architecture first.