SANKET vs Element (Matrix): secure messaging compared
Element, built on the Matrix standard, is used by governments and enterprises and can be self-hosted. SANKET brings Signal's libsignal with post-quantum PQXDH and SPQR, per-device group encryption, device mutual TLS and signed releases, as a single-organisation installation under the customer's control.
About Element / Matrix
Element Creations Ltd; Matrix.org Foundation · United Kingdom
Element is a secure communication platform from Element Creations Ltd in the UK, built on the open Matrix standard stewarded by the non-profit Matrix.org Foundation. It uses Olm and Megolm encryption, end-to-end encrypts direct messages, private rooms and calls, and is deployed self-hosted or fully managed through Element Server Suite.
SANKET vs Element / Matrix: side by side
| Criterion | SANKET | Element / Matrix |
|---|---|---|
| Who controls the infrastructure | The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path. | The customer (self-hosted Element Server Suite) or Element (fully managed). |
| Deployment options | Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery. | Self-hosted or fully managed; cross-domain solutions linking air-gapped networks. |
| Who holds keys and identity | The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required. | Matrix user IDs on the operator's homeserver. Key management: not publicly documented. |
| Encryption protocol | Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only. | Olm (one-to-one) and Megolm (groups), implemented in vodozemac. |
| Post-quantum protection | Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge. | Not publicly documented |
| Groups and calls end-to-end encrypted by default | Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM. | Yes for direct messages and private rooms; voice and video calls end-to-end encrypted with Element Call. |
| Customer identity provider (SSO / LDAP) | Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators. | OIDC, LDAP, Active Directory, SAML and SCIM in Element Server Suite Pro (for example Keycloak, Entra ID and Okta). |
| Admin controls and device governance | Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM. | Not publicly documented |
| Data sovereignty (jurisdiction, built in India) | Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products. | Element Creations Ltd, United Kingdom; Matrix stewarded by the Matrix.org Foundation. |
| Release integrity and update control | Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package. | Not publicly documented |
| Platforms | Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack. | iOS, Android, macOS, Windows, Linux and web. |
Who controls the infrastructure
SANKET
The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path.
Element / Matrix
The customer (self-hosted Element Server Suite) or Element (fully managed).Deployment options
SANKET
Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery.
Element / Matrix
Self-hosted or fully managed; cross-domain solutions linking air-gapped networks.Who holds keys and identity
SANKET
The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required.
Element / Matrix
Matrix user IDs on the operator's homeserver. Key management: not publicly documented.Encryption protocol
SANKET
Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only.
Element / Matrix
Olm (one-to-one) and Megolm (groups), implemented in vodozemac.Post-quantum protection
SANKET
Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge.
Element / Matrix
Not publicly documentedGroups and calls end-to-end encrypted by default
SANKET
Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM.
Element / Matrix
Yes for direct messages and private rooms; voice and video calls end-to-end encrypted with Element Call.Customer identity provider (SSO / LDAP)
SANKET
Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators.
Element / Matrix
OIDC, LDAP, Active Directory, SAML and SCIM in Element Server Suite Pro (for example Keycloak, Entra ID and Okta).Admin controls and device governance
SANKET
Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM.
Element / Matrix
Not publicly documentedData sovereignty (jurisdiction, built in India)
SANKET
Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products.
Element / Matrix
Element Creations Ltd, United Kingdom; Matrix stewarded by the Matrix.org Foundation.Release integrity and update control
SANKET
Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package.
Element / Matrix
Not publicly documentedPlatforms
SANKET
Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack.
Element / Matrix
iOS, Android, macOS, Windows, Linux and web.Where SANKET leads
- Signal's libsignal with post-quantum PQXDH and SPQR for all messaging.
- Pairwise per-device group encryption: there is no shared group key, and removal takes effect immediately for future messages.
- A single-organisation installation by default, with separation between organisations by installation.
- Device trust controls: device approval, signed device lists, device mutual TLS, hardware-backed keys with recorded protection level, and remote wipe.
- Release integrity with signed manifests, rollback protection and signed offline packages.
Frequently asked questions
What is a good Element or Matrix alternative?
SANKET (Sanket.Chat) by Tosh Defence: Signal Protocol with post-quantum PQXDH and SPQR, per-device group encryption and full device governance, in a dedicated installation the organisation controls.
How does SANKET encrypt group messages?
Each group message is encrypted separately for every recipient device through libsignal. There is no shared group key, so removing a member takes effect immediately for future messages.
Can SANKET be self-hosted?
Yes. Every SANKET deployment is a dedicated installation: on the customer's premises, fully air-gapped, or on any cloud and region it chooses.
Sources
- SANKET Technical Security & Architecture Whitepaper, public edition 2.0 (7 October 2026)
- Element: About
- Element: Features
- Element blog: Element Call
- Matrix.org: Independent public audit of vodozemac (16 May 2022)
- Element Server Suite
- Element: Identity and access management
- Element personal
- SFLC.in: Security and privacy features analysis of messaging applications (12 October 2025)
Sources checked on 7 October 2026. Competitor facts are taken only from the sources listed. Where no public source was found, the cell reads 'Not publicly documented'. Product and company names are trademarks of their respective owners.
Put your communications under your own control
Talk to the Tosh Defence team about your deployment, from a dedicated cloud installation to a fully air-gapped estate, or read the full security architecture first.