SANKET vs Signal: the Signal alternative for organisations
SANKET and Signal share the same cryptographic core: Signal Protocol with post-quantum PQXDH and SPQR. Signal is a single shared service for the public. SANKET puts that cryptography on the organisation's own infrastructure, in its own jurisdiction, with its own identity provider, device governance, policies and update timing.
About Signal
Signal Technology Foundation · USA
Signal is a messaging app from the Signal Technology Foundation, a US non-profit, and the origin of the Signal Protocol. Messages, calls and media are end-to-end encrypted by default, and Signal introduced post-quantum PQXDH in 2023 and the SPQR ratchet in 2025. Its protocol is the foundation SANKET builds on.
SANKET vs Signal: side by side
| Criterion | SANKET | Signal |
|---|---|---|
| Who controls the infrastructure | The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path. | Signal operates a single shared service. |
| Deployment options | Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery. | Signal-operated service. Enterprise self-hosting: not publicly documented. |
| Who holds keys and identity | The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required. | Accounts registered with a phone number; optional usernames keep the number private (February 2024). |
| Encryption protocol | Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only. | Signal Protocol: PQXDH, Double Ratchet and SPQR. |
| Post-quantum protection | Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge. | Yes: PQXDH since September 2023; SPQR announced October 2025 and rolling out gradually. |
| Groups and calls end-to-end encrypted by default | Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM. | Yes: messages, calls and media end-to-end encrypted by default. |
| Customer identity provider (SSO / LDAP) | Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators. | Not publicly documented |
| Admin controls and device governance | Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM. | Not publicly documented |
| Data sovereignty (jurisdiction, built in India) | Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products. | Signal Technology Foundation, a US 501(c)(3) non-profit. |
| Release integrity and update control | Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package. | Not publicly documented |
| Platforms | Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack. | Android, iOS and iPadOS, macOS, Windows and Linux; desktop links to a phone; no web client. |
Who controls the infrastructure
SANKET
The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path.
Signal
Signal operates a single shared service.Deployment options
SANKET
Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery.
Signal
Signal-operated service. Enterprise self-hosting: not publicly documented.Who holds keys and identity
SANKET
The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required.
Signal
Accounts registered with a phone number; optional usernames keep the number private (February 2024).Encryption protocol
SANKET
Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only.
Signal
Signal Protocol: PQXDH, Double Ratchet and SPQR.Post-quantum protection
SANKET
Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge.
Signal
Yes: PQXDH since September 2023; SPQR announced October 2025 and rolling out gradually.Groups and calls end-to-end encrypted by default
SANKET
Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM.
Signal
Yes: messages, calls and media end-to-end encrypted by default.Customer identity provider (SSO / LDAP)
SANKET
Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators.
Signal
Not publicly documentedAdmin controls and device governance
SANKET
Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM.
Signal
Not publicly documentedData sovereignty (jurisdiction, built in India)
SANKET
Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products.
Signal
Signal Technology Foundation, a US 501(c)(3) non-profit.Release integrity and update control
SANKET
Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package.
Signal
Not publicly documentedPlatforms
SANKET
Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack.
Signal
Android, iOS and iPadOS, macOS, Windows and Linux; desktop links to a phone; no web client.Where SANKET leads
- The same cryptographic core, owned by the organisation: Signal's own libsignal with PQXDH and SPQR, running on the customer's servers, in the customer's jurisdiction, including air-gapped.
- Administration built for organisations: device approval and revocation, retention and feature policy, classification labels and encrypted priority broadcast with acknowledgement.
- Customer identity: Sanket IDs, SCIM provisioning, sign-in through the organisation's own directory and FIDO2 security keys for administrators.
- Signed device lists, verified by senders against the installation's own append-only log before every message is encrypted.
- AES-256 throughout calls: AES-256-GCM frame encryption inside SRTP AES-256-GCM, through the customer's own media server.
Frequently asked questions
What is the best Signal alternative for organisations?
SANKET (Sanket.Chat) by Tosh Defence. It uses Signal's own libsignal with post-quantum PQXDH and SPQR, and runs on the organisation's own infrastructure with its own identity provider, device governance and update control.
Does SANKET use the Signal Protocol?
Yes. SANKET uses Signal's official, independently audited libsignal on iOS, Android, desktop and server, with PQXDH key agreement and the Double Ratchet with SPQR. There is no custom or fallback protocol.
Can SANKET run without the internet?
Yes. A SANKET installation can run on a closed or fully air-gapped network with an internal certificate authority, offline licences and signed offline updates.
Who controls the servers in SANKET?
The customer. Each organisation has one dedicated installation, on its own premises, air-gapped, or on any cloud and region it chooses.
Sources
- SANKET Technical Security & Architecture Whitepaper, public edition 2.0 (7 October 2026)
- Signal: Donate (Signal Technology Foundation)
- Signal documentation
- Signal blog: Quantum resistance and the Signal Protocol (PQXDH)
- Signal blog: SPQR
- Signal blog: Phone number privacy and usernames (20 February 2024)
- Signal download page
- SFLC.in: Security and privacy features analysis of messaging applications (12 October 2025)
Sources checked on 7 October 2026. Competitor facts are taken only from the sources listed. Where no public source was found, the cell reads 'Not publicly documented'. Product and company names are trademarks of their respective owners.
Put your communications under your own control
Talk to the Tosh Defence team about your deployment, from a dedicated cloud installation to a fully air-gapped estate, or read the full security architecture first.