SANKET vs Arattai: secure Indian messaging compared
Both SANKET and Arattai are built in India. Arattai is Zoho's messaging app for everyday conversations; SANKET is a sovereign secure communication platform that an organisation runs on its own infrastructure, with its own keys, identity provider, policies and update timing. For an organisation that needs control, not only privacy, SANKET is the Arattai alternative built for the job.
About Arattai
Zoho (Arattai Technology Solutions Private Limited) · India
Arattai is a messaging app from Zoho, launched in January 2021 for everyday conversations. Direct chats became end-to-end encrypted in November 2025, voice and video calls are end-to-end encrypted, and group end-to-end encryption was announced in September 2026. User data is stored on servers in India.
SANKET vs Arattai: side by side
| Criterion | SANKET | Arattai |
|---|---|---|
| Who controls the infrastructure | The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path. | Zoho operates the service. |
| Deployment options | Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery. | Zoho-operated service; user data stored on servers located in India (App Store listing). |
| Who holds keys and identity | The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required. | Accounts on Zoho's service; the App Store privacy label lists the phone number as data linked to the user. Key management: not publicly documented. |
| Encryption protocol | Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only. | Not publicly documented |
| Post-quantum protection | Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge. | Not publicly documented |
| Groups and calls end-to-end encrypted by default | Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM. | Direct chats end-to-end encrypted (mandatory since November 2025); voice and video calls end-to-end encrypted; group encryption announced September 2026, default status not publicly documented. |
| Customer identity provider (SSO / LDAP) | Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators. | Not publicly documented |
| Admin controls and device governance | Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM. | Not publicly documented |
| Data sovereignty (jurisdiction, built in India) | Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products. | Built by Zoho, headquartered in Chennai, India; user data stored in India. |
| Release integrity and update control | Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package. | Not publicly documented |
| Platforms | Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack. | Android, iOS, desktop, web and tablet; up to five devices. |
Who controls the infrastructure
SANKET
The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path.
Arattai
Zoho operates the service.Deployment options
SANKET
Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery.
Arattai
Zoho-operated service; user data stored on servers located in India (App Store listing).Who holds keys and identity
SANKET
The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required.
Arattai
Accounts on Zoho's service; the App Store privacy label lists the phone number as data linked to the user. Key management: not publicly documented.Encryption protocol
SANKET
Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only.
Arattai
Not publicly documentedPost-quantum protection
SANKET
Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge.
Arattai
Not publicly documentedGroups and calls end-to-end encrypted by default
SANKET
Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM.
Arattai
Direct chats end-to-end encrypted (mandatory since November 2025); voice and video calls end-to-end encrypted; group encryption announced September 2026, default status not publicly documented.Customer identity provider (SSO / LDAP)
SANKET
Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators.
Arattai
Not publicly documentedAdmin controls and device governance
SANKET
Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM.
Arattai
Not publicly documentedData sovereignty (jurisdiction, built in India)
SANKET
Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products.
Arattai
Built by Zoho, headquartered in Chennai, India; user data stored in India.Release integrity and update control
SANKET
Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package.
Arattai
Not publicly documentedPlatforms
SANKET
Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack.
Arattai
Android, iOS, desktop, web and tablet; up to five devices.Where SANKET leads
- Organisation-owned deployment: one dedicated SANKET installation per customer, on infrastructure it owns, including closed and air-gapped networks.
- Published, defence-grade cryptography: Signal's official libsignal with post-quantum PQXDH and SPQR, and AES-256 for messages, files and calls.
- Organisational control: FIDO2 security keys for administrators, device approval and revocation, lost mode, remote wipe and customer-defined classification labels inside the encryption.
- Customer identity: users are identified by Sanket ID and can sign in through the organisation's own directory, with no consumer phone-number identity required.
- Two Indian products, two purposes: SANKET adds customer-run, hash-chained audit logs that export to the organisation's own SIEM.
Frequently asked questions
What is the best Arattai alternative for organisations?
SANKET (Sanket.Chat) by Tosh Defence. Like Arattai it is built in India, and it adds what organisations need: its own dedicated installation, Signal Protocol with post-quantum protection, its own identity provider and full device governance.
Are SANKET and Arattai both Indian?
Yes. Arattai is built by Zoho, headquartered in Chennai. SANKET is built in India by Tosh Defence, headquartered in Gurgaon, and is deployed on infrastructure each customer chooses.
Can an organisation host SANKET itself?
Yes. SANKET runs as a dedicated installation on any cloud the organisation chooses, on its own premises, or fully air-gapped, with offline licences and signed offline updates.
Which encryption does SANKET use?
Signal Protocol through Signal's official, independently audited libsignal, with PQXDH and the SPQR post-quantum ratchet. Files and calls use AES-256-GCM, and transport uses AES-256-GCM TLS suites only.
Sources
- SANKET Technical Security & Architecture Whitepaper, public edition 2.0 (7 October 2026)
- Arattai official website
- Arattai on the Apple App Store
- Zoho: About us
- Outlook Money: Arattai rolls out end-to-end encryption for direct chats (19 November 2025)
- Storyboard18: Arattai rolls out end-to-end encryption for group chats (25 September 2026)
- SFLC.in: Security and privacy features analysis of messaging applications (12 October 2025)
Sources checked on 7 October 2026. Competitor facts are taken only from the sources listed. Where no public source was found, the cell reads 'Not publicly documented'. Product and company names are trademarks of their respective owners.
Put your communications under your own control
Talk to the Tosh Defence team about your deployment, from a dedicated cloud installation to a fully air-gapped estate, or read the full security architecture first.