SANKET vs Private Discuss: sovereign secure messaging compared
Private Discuss and SANKET both serve government, defence and critical industry with on-premise and isolated deployment. SANKET is built on Signal's independently audited libsignal with post-quantum PQXDH and SPQR, AES-256 throughout, signed device lists and device mutual TLS, from an Indian vendor.
About Private Discuss
Private Discuss (PIMAN Group) · France
Private Discuss is a French secure messaging, video-conferencing and collaboration platform from the PIMAN Group, founded in 2018 and based near Lyon. It serves government, defence, energy, nuclear, finance and healthcare, deploys on-premise, in a private cloud or as SaaS through French hosts, and can operate on isolated networks.
SANKET vs Private Discuss: side by side
| Criterion | SANKET | Private Discuss |
|---|---|---|
| Who controls the infrastructure | The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path. | The customer (on-premise or private cloud) or SaaS through French hosts Scaleway and OVHcloud. |
| Deployment options | Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery. | On-premise, private cloud or SaaS; can operate on isolated networks. |
| Who holds keys and identity | The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required. | Vendor states that only the user holds the keys. Identity: not publicly documented. |
| Encryption protocol | Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only. | Not publicly documented |
| Post-quantum protection | Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge. | Not publicly documented |
| Groups and calls end-to-end encrypted by default | Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM. | Vendor states end-to-end encryption from camera and microphone to the receiving screen; group and call defaults not separately documented. |
| Customer identity provider (SSO / LDAP) | Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators. | Not publicly documented |
| Admin controls and device governance | Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM. | Granular control of access and data flows (press). |
| Data sovereignty (jurisdiction, built in India) | Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products. | Private Discuss, PIMAN Group, Limonest (Lyon), France. |
| Release integrity and update control | Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package. | Not publicly documented |
| Platforms | Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack. | Windows, macOS, Linux, iOS, Android and web. |
Who controls the infrastructure
SANKET
The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path.
Private Discuss
The customer (on-premise or private cloud) or SaaS through French hosts Scaleway and OVHcloud.Deployment options
SANKET
Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery.
Private Discuss
On-premise, private cloud or SaaS; can operate on isolated networks.Who holds keys and identity
SANKET
The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required.
Private Discuss
Vendor states that only the user holds the keys. Identity: not publicly documented.Encryption protocol
SANKET
Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only.
Private Discuss
Not publicly documentedPost-quantum protection
SANKET
Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge.
Private Discuss
Not publicly documentedGroups and calls end-to-end encrypted by default
SANKET
Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM.
Private Discuss
Vendor states end-to-end encryption from camera and microphone to the receiving screen; group and call defaults not separately documented.Customer identity provider (SSO / LDAP)
SANKET
Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators.
Private Discuss
Not publicly documentedAdmin controls and device governance
SANKET
Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM.
Private Discuss
Granular control of access and data flows (press).Data sovereignty (jurisdiction, built in India)
SANKET
Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products.
Private Discuss
Private Discuss, PIMAN Group, Limonest (Lyon), France.Release integrity and update control
SANKET
Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package.
Private Discuss
Not publicly documentedPlatforms
SANKET
Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack.
Private Discuss
Windows, macOS, Linux, iOS, Android and web.Where SANKET leads
- Built on Signal's official, independently audited libsignal, with no custom or fallback protocol.
- A public security whitepaper that sets out SANKET's threat model, key hierarchy and cryptography for evaluators.
- Post-quantum messaging (PQXDH and SPQR) and AES-256-GCM for files and calls.
- Signed device lists and device mutual TLS for every approved device.
- Built in India, for organisations that require an Indian vendor and Indian-controlled infrastructure.
Frequently asked questions
Is Private Discuss an Indian app?
No. Private Discuss is a French company of the PIMAN Group, based in Limonest near Lyon. SANKET (Sanket.Chat) by Tosh Defence is the secure communication platform built in India.
Which protocol does SANKET use?
Signal Protocol through Signal's official, independently audited libsignal, with PQXDH and the SPQR post-quantum ratchet, and AES-256-GCM for files and calls.
Can SANKET run on an isolated network?
Yes. SANKET runs fully air-gapped with an internal certificate authority, offline licences and signed offline release packages.
Sources
- SANKET Technical Security & Architecture Whitepaper, public edition 2.0 (7 October 2026)
- Private Discuss: About
- Private Discuss website
- Le Monde Informatique: Focus on Private Discuss (17 November 2025)
- Solutions Numeriques (31 October 2025)
Sources checked on 7 October 2026. Competitor facts are taken only from the sources listed. Where no public source was found, the cell reads 'Not publicly documented'. Product and company names are trademarks of their respective owners.
Put your communications under your own control
Talk to the Tosh Defence team about your deployment, from a dedicated cloud installation to a fully air-gapped estate, or read the full security architecture first.