Secure communication for defence and the armed forces
SANKET (Sanket.Chat) by Tosh Defence is a sovereign, defence-grade secure communication platform for armed forces and defence organisations: end-to-end encrypted messaging, file exchange, voice and video calls and priority broadcast, built on Signal's independently audited libsignal with post-quantum protection and AES-256. Each force runs its own dedicated installation on infrastructure it owns, from a secured data centre to a fully air-gapped network, so the keys, the servers and the audit trail never leave its control.
Built in India, for sovereign nations. SANKET is designed for command communications, dispersed units and contested networks, where a foreign-hosted messaging service is not an acceptable dependency.
Why defence needs more than an encrypted app
Encryption answers only one question: whether someone on the network can read a message. A defence organisation must also control who runs the service, which jurisdiction can compel it, what the software reports back to a vendor, who decides when it changes and whether it keeps working when it is cut off from the internet.
SANKET answers every one of those questions inside the organisation's own security boundary. There is no vendor-operated server in the message path, no third-party analytics in any product application and no foreign runtime dependency.
Command communications, end to end
Messages, reactions and encrypted broadcasts are encrypted on the sending device with Signal's official libsignal library. Group messages are encrypted separately for every trusted device of every member, so a removed member is simply no longer in the fan-out and no shared group key exists to leak.
Encrypted priority broadcast reaches every recipient device with an acknowledgement deadline. Priority, deadline and expiry travel inside the encryption, so the server cannot downgrade or replay an order.
- One-to-one and group messaging
- Encrypted file exchange with AES-256-GCM per file
- Voice and video calls with AES-256-GCM frame encryption
- Priority broadcast with acknowledgement
Classification and handling controls
Each installation defines its own ranked classification labels, up to eight, with a default. The label is carried inside the end-to-end encrypted message, so the server can neither read nor alter it, and content above the lowest rank cannot be forwarded, exported or downloaded on mobile or desktop.
Strong separation between security domains is achieved the way defence networks already work: a separate, dedicated installation for each domain, each with its own keys, administrators and audit trail.
Devices you can trust, and revoke
Every device is approved before it can receive anything. Device keys are protected by the phone's hardware security (Secure Enclave on iOS, StrongBox or the trusted execution environment on Android), each account's device list is signed by its own devices so the server cannot silently add a listener, and every approved device presents its own client certificate through mutual TLS.
A lost or seized device can be placed in lost mode, revoked and remotely wiped by the organisation's administrators.
Built for the field
Calls are engineered for 3G and congested 4G links, adapting audio and video to keep voice intelligible. Where a network allows only HTTPS on TCP 443, calls still connect, with media end-to-end encrypted inside the tunnel. Clients queue outgoing messages in an encrypted outbox and the installation holds ciphertext until a disconnected device returns.
Technical proof
Read the detail in the SANKET whitepaper
Every statement on this page is set out in full in the public SANKET Technical Security and Architecture Whitepaper, free to read without registration.
What is the best secure messaging platform for the armed forces?
Armed forces need end-to-end encryption plus full control of the infrastructure. SANKET by Tosh Defence combines Signal's independently audited libsignal, post-quantum key agreement and AES-256 with a dedicated installation the force owns, including fully air-gapped deployment, administrator security keys and signed device lists.
Can SANKET run on a military network with no internet access?
Yes. SANKET runs on closed and air-gapped networks with an internal certificate authority, self-hosted push for Android, offline licence validation and signed offline release packages. No SANKET component needs to connect outside the enclave.
Can Tosh Defence read our messages?
No. Tosh Defence does not operate customer installations and has no access path into them. Message content is end-to-end encrypted with keys that exist only on users' devices.
Does SANKET support classification markings?
Yes. Each installation defines up to eight ranked classification labels. Labels travel inside the end-to-end encryption, and content above the lowest rank cannot be forwarded, exported or downloaded.
Is SANKET certified for defence use?
SANKET is built on Signal's independently audited libsignal and is designed to support national evaluation. Security audit by a CERT-In empanelled auditor and evaluation through the appropriate national cryptographic scheme, including the SAG pathway, are Tosh Defence's certification targets.
Which devices does SANKET support?
Native apps for iOS, Android, Windows, macOS and Linux. There is deliberately no web client: a browser-free design removes a whole class of script-injection and browser-extension attack paths.
Brief your evaluation team on SANKET
Tosh Defence works with defence evaluation committees, security architects and procurement teams through a structured technical evaluation, including the controlled edition of the whitepaper under a non-disclosure agreement.