Secure communication for critical infrastructure operators
SANKET (Sanket.Chat) by Tosh Defence is a secure communication platform for energy, water, transport and telecom operators that keeps working when other systems are under stress. It provides end-to-end encrypted messaging, files, calls and priority broadcast on an independent installation the operator owns, including segmented operational networks and fully closed networks.
Incident coordination cannot depend on the systems that may be under attack. SANKET gives operators an out-of-band channel with its own infrastructure, its own identity domain and high availability with second-site recovery.
An out-of-band channel for incident response
When primary systems may be compromised, incident and security operations teams need a channel that does not share their infrastructure, identities or provider. A SANKET installation is exactly that: independent servers, a separate identity domain and end-to-end encryption that keeps content off even the operator's own servers.
Made for segmented and disconnected networks
SANKET runs on private and fully closed networks with an internal certificate authority, self-hosted push for Android devices and offline licence validation. Clients keep working with local data while disconnected, queue outgoing messages in an encrypted outbox and deliver them when connectivity returns.
- Internal certificate authority
- Self-hosted push for Android
- Offline licences and signed offline releases
- Encrypted outbox for intermittent links
Resilience engineered in
The high-availability profile runs on several hosts: two edge hosts, more than one application and media node, replicated databases with fenced failover and replicated storage, with asynchronous replication to a second site and drill tooling to fence, promote, switch and fail back.
Upgrades are designed to preserve service: a new version takes over only once it is healthy, and any failure rolls back automatically.
Alerting the whole workforce, with proof of receipt
Encrypted priority broadcast reaches every recipient device with an acknowledgement deadline, so control rooms know who has received an instruction. Priority, deadline and expiry are inside the encryption, where no server can alter them.
Technical proof
Read the detail in the SANKET whitepaper
Every statement on this page is set out in full in the public SANKET Technical Security and Architecture Whitepaper, free to read without registration.
Why do critical infrastructure operators need a separate secure communication platform?
Because incident coordination must keep working when corporate IT, email or public services are degraded or compromised. SANKET is an independent, end-to-end encrypted installation with its own infrastructure and identity domain.
Can SANKET run on an operational technology network?
Yes. SANKET runs on private, segmented and fully air-gapped networks, with an internal certificate authority, self-hosted Android push and offline licensing.
Is SANKET highly available?
Yes. The multi-host high-availability profile provides redundant edge, application and media nodes, replicated databases with fenced failover and asynchronous replication to a second site with drill tooling for failover and failback.
Does SANKET integrate with our security operations centre?
Yes. Security and administrative events are exported to the operator's SIEM over TLS-protected syslog, and the Integration API and signed webhooks connect SANKET to internal systems.
What happens to messages when a site loses connectivity?
Devices keep working with local data and queue outgoing messages in an encrypted outbox. The installation holds ciphertext for offline devices and delivers it when they reconnect.
Plan a resilient, sovereign communication channel
Tosh Defence helps operators design the right topology, from a single site to high availability with second-site recovery, on their own networks.