SANKET vs Telegram: secure messaging compared
Telegram is a cloud messaging service known for its public channels. SANKET is built for organisations whose conversations must stay confidential: every message, file, reaction, encrypted broadcast and call is end-to-end encrypted through Signal's libsignal, on infrastructure the organisation owns.
About Telegram
Telegram · United Arab Emirates (development team based in Dubai)
Telegram is a messaging app known for its cloud chats and public channels, developed by a team based in Dubai. It uses its own MTProto 2.0 protocol, offers opt-in end-to-end encrypted Secret Chats, and end-to-end encrypts voice and video calls, including group calls of up to 200 participants.
SANKET vs Telegram: side by side
| Criterion | SANKET | Telegram |
|---|---|---|
| Who controls the infrastructure | The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path. | Telegram operates the service, with data centres across several jurisdictions. |
| Deployment options | Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery. | Telegram-operated service. |
| Who holds keys and identity | The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required. | The phone number identifies each user. |
| Encryption protocol | Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only. | MTProto 2.0. |
| Post-quantum protection | Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge. | Not publicly documented |
| Groups and calls end-to-end encrypted by default | Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM. | Cloud chats use client-server encryption; Secret Chats (opt-in, one-to-one) are end-to-end encrypted; voice and video calls, including group calls up to 200 participants, are end-to-end encrypted. |
| Customer identity provider (SSO / LDAP) | Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators. | Not publicly documented |
| Admin controls and device governance | Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM. | Not publicly documented |
| Data sovereignty (jurisdiction, built in India) | Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products. | Development team based in Dubai, UAE. |
| Release integrity and update control | Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package. | Verifiable builds for the iOS and Android apps. |
| Platforms | Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack. | iOS, Android, Windows, macOS, Linux and web. |
Who controls the infrastructure
SANKET
The customer. One dedicated installation per organisation, on infrastructure it owns or chooses, with no vendor-operated service in the message path.
Telegram
Telegram operates the service, with data centres across several jurisdictions.Deployment options
SANKET
Dedicated installation on any cloud in any region the customer chooses (or Tosh Defence hosting), customer on-premise, or fully air-gapped; single host or high availability with second-site recovery.
Telegram
Telegram-operated service.Who holds keys and identity
SANKET
The customer and its users. Keys are generated on each device and protected by hardware-backed storage; identities are customer-controlled Sanket IDs, with no consumer phone-number identity required.
Telegram
The phone number identifies each user.Encryption protocol
SANKET
Signal Protocol through Signal's official, independently audited libsignal. Messages AES-256-CBC with HMAC-SHA256 inside libsignal; files and calls AES-256-GCM; TLS with AES-256-GCM suites only.
Telegram
MTProto 2.0.Post-quantum protection
SANKET
Yes, in the current release: PQXDH with a mandatory post-quantum Kyber prekey and the SPQR ratchet (Triple Ratchet), plus hybrid X25519MLKEM768 key exchange at the TLS edge.
Telegram
Not publicly documentedGroups and calls end-to-end encrypted by default
SANKET
Yes. One-to-one and group messages, reactions, encrypted broadcasts and files are always end-to-end encrypted; voice and video calls use AES-256-GCM frame encryption with five new frame keys per second, inside SRTP AES-256-GCM.
Telegram
Cloud chats use client-server encryption; Secret Chats (opt-in, one-to-one) are end-to-end encrypted; voice and video calls, including group calls up to 200 participants, are end-to-end encrypted.Customer identity provider (SSO / LDAP)
SANKET
Yes. Sign-in through the customer's own OIDC, SAML 2.0 or LDAP directory, SCIM 2.0 provisioning, and FIDO2 security keys for administrators.
Telegram
Not publicly documentedAdmin controls and device governance
SANKET
Device approval and revocation, lost mode and remote wipe, signed device lists, device mutual TLS, retention, forwarding and clipboard policy, customer-defined classification labels and a hash-chained audit log for the customer's SIEM.
Telegram
Not publicly documentedData sovereignty (jurisdiction, built in India)
SANKET
Built in India by Tosh Defence. Data stays in the jurisdiction and on the infrastructure the customer chooses, with no third-party analytics and no foreign runtime dependency in the products.
Telegram
Development team based in Dubai, UAE.Release integrity and update control
SANKET
Ed25519-signed releases verified before install, with release freeze and rollback protection and automatic rollback on a failed upgrade. The customer decides when to upgrade, online or with a signed offline package.
Telegram
Verifiable builds for the iOS and Android apps.Platforms
SANKET
Native apps for iOS, Android, Windows, macOS and Linux. Browser-free by design: there is no web client to attack.
Telegram
iOS, Android, Windows, macOS, Linux and web.Where SANKET leads
- End-to-end encryption for every conversation that carries content: one-to-one and group messages, reactions, encrypted broadcasts, files and calls.
- Signal's official libsignal with post-quantum PQXDH and SPQR, and AES-256 for messages, files and calls.
- Self-hosted in the customer's jurisdiction, with no vendor-operated service in the message path.
- Server-blind content: the server relays ciphertext and never holds the keys to messages, files, calls, reactions or encrypted broadcasts.
- Customer-controlled identity with Sanket IDs and the organisation's own directory, with no phone-number identity required.
Frequently asked questions
Is SANKET a Telegram alternative for organisations?
Yes. SANKET (Sanket.Chat) by Tosh Defence end-to-end encrypts every message, group, file and call through Signal's libsignal, on infrastructure the organisation owns.
Are SANKET group chats end-to-end encrypted?
Yes, always. Each group message is encrypted separately for every recipient device with libsignal, so there is no shared group key, and a removed member cannot read future messages.
Does SANKET need a phone number?
No consumer phone-number identity is required. Users are identified by Sanket ID, and a deployment without an SMS provider does not collect phone numbers at all.
Sources
- SANKET Technical Security & Architecture Whitepaper, public edition 2.0 (7 October 2026)
- Telegram FAQ
- Telegram: End-to-end encryption (core.telegram.org)
Sources checked on 7 October 2026. Competitor facts are taken only from the sources listed. Where no public source was found, the cell reads 'Not publicly documented'. Product and company names are trademarks of their respective owners.
Put your communications under your own control
Talk to the Tosh Defence team about your deployment, from a dedicated cloud installation to a fully air-gapped estate, or read the full security architecture first.