SANKET vs Rocket.Chat: secure team messaging compared
Rocket.Chat is a flexible team collaboration platform that can run on-premises and air-gapped. SANKET is end-to-end encrypted by design for every message, file and call, with Signal's libsignal, post-quantum PQXDH and SPQR, signed device lists and device mutual TLS, under the organisation's full control.
About Rocket.Chat
Rocket.Chat Technologies Corp · Brazil (offices in the USA and Europe)
Rocket.Chat is a team collaboration platform founded in 2015 and headquartered in Porto Alegre, Brazil. It deploys on-premises, air-gapped, in a sovereign or private cloud or in Rocket.Chat's hosted cloud, integrates with LDAP, SAML and OpenID Connect, and serves enterprise, government and defence organisations.
SANKET vs Rocket.Chat: side by side
| Criterion | SANKET | Rocket.Chat |
|---|---|---|
| Who controls the infrastructure | The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path. | The customer (self-managed) or Rocket.Chat's hosted cloud. |
| Deployment options | Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery. | On-premises, air-gapped, sovereign or private cloud, or Rocket.Chat hosted cloud. |
| Who holds keys and identity | The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required. | Workspace accounts; no phone number required. Key management: not publicly documented. |
| Encryption protocol | Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only. | Not publicly documented |
| Post-quantum protection | Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge. | Post-quantum algorithms on the vendor's roadmap. |
| Groups and calls end-to-end encrypted by default | Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM. | End-to-end encryption is enabled by a workspace administrator, who can enforce it for new private rooms and direct messages. |
| Customer identity provider (SSO / LDAP) | Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators. | LDAP, SAML and OAuth / OpenID Connect (for example Keycloak and Entra ID); LDAP and SAML use a Premium module from version 9.0.0. |
| Admin controls and device governance | Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM. | Not publicly documented |
| Data sovereignty (jurisdiction, built in India) | Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products. | Rocket.Chat Technologies Corp, Porto Alegre, Brazil, with offices in the USA and Europe. |
| Release integrity and update control | Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package. | Not publicly documented |
| Platforms | Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack. | Web, desktop and mobile (vendor). |
Who controls the infrastructure
SANKET
The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path.
Rocket.Chat
The customer (self-managed) or Rocket.Chat's hosted cloud.Deployment options
SANKET
Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery.
Rocket.Chat
On-premises, air-gapped, sovereign or private cloud, or Rocket.Chat hosted cloud.Who holds keys and identity
SANKET
The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required.
Rocket.Chat
Workspace accounts; no phone number required. Key management: not publicly documented.Encryption protocol
SANKET
Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only.
Rocket.Chat
Not publicly documentedPost-quantum protection
SANKET
Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge.
Rocket.Chat
Post-quantum algorithms on the vendor's roadmap.Groups and calls end-to-end encrypted by default
SANKET
Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM.
Rocket.Chat
End-to-end encryption is enabled by a workspace administrator, who can enforce it for new private rooms and direct messages.Customer identity provider (SSO / LDAP)
SANKET
Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators.
Rocket.Chat
LDAP, SAML and OAuth / OpenID Connect (for example Keycloak and Entra ID); LDAP and SAML use a Premium module from version 9.0.0.Admin controls and device governance
SANKET
Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM.
Rocket.Chat
Not publicly documentedData sovereignty (jurisdiction, built in India)
SANKET
Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products.
Rocket.Chat
Rocket.Chat Technologies Corp, Porto Alegre, Brazil, with offices in the USA and Europe.Release integrity and update control
SANKET
Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package.
Rocket.Chat
Not publicly documentedPlatforms
SANKET
Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack.
Rocket.Chat
Web, desktop and mobile (vendor).Where SANKET leads
- End-to-end encryption by design for all messaging: messages, reactions, broadcasts and labels go through libsignal, and files are encrypted with AES-256-GCM on the device.
- Post-quantum messaging in the current release (PQXDH and SPQR) and hybrid post-quantum TLS at the edge.
- Calls end-to-end encrypted with per-sender AES-256-GCM frame keys delivered over libsignal; the media server cannot decrypt them.
- Signed device lists and device mutual TLS for every approved device.
- FIDO2 security keys for administrators, verified by the installation itself with no external service.
Frequently asked questions
Is SANKET a Rocket.Chat alternative?
Yes, for organisations that want every conversation end-to-end encrypted by design. SANKET (Sanket.Chat) by Tosh Defence uses Signal's libsignal with post-quantum protection for every message, file and call.
Can SANKET be air-gapped?
Yes. SANKET runs fully air-gapped with an internal certificate authority, offline licences and signed offline updates, single host or high availability with a second site.
Does SANKET integrate with LDAP and SAML?
Yes. Sign-in can be federated to the organisation's own OIDC, SAML 2.0 or LDAP directory, with SCIM 2.0 provisioning.
Sources
- SANKET Technical Security & Architecture Whitepaper, public edition 2.0 (7 October 2026)
- Rocket.Chat: Defense
- Rocket.Chat Docs: End-to-end encryption
- Rocket.Chat Docs: End-to-end encryption FAQ
- Rocket.Chat: Alternatives
- Rocket.Chat Docs: Authentication
- Rocket.Chat Docs: Authentication across plans
- We Work Remotely: Rocket.Chat company profile
Sources checked on 7 October 2026. Competitor facts are taken only from the sources listed. Where no public source was found, the cell reads 'Not publicly documented'. Product and company names are trademarks of their respective owners.
Put your communications under your own control
Talk to the Tosh Defence team about your deployment, from a dedicated cloud installation to a fully air-gapped estate, or read the full security architecture first.