Secure communication for law enforcement agencies
SANKET (Sanket.Chat) by Tosh Defence is a secure communication platform for police and law-enforcement agencies: end-to-end encrypted messaging, file exchange, voice and video calls and priority broadcast on an installation the agency controls. It protects case confidentiality and the integrity of instructions with Signal's independently audited libsignal, AES-256 and strict device trust.
Field officers, investigators and command staff share sensitive case information every day. SANKET keeps it inside the agency, on devices the agency approves and can revoke at any moment.
Case confidentiality from the first message
Every message, attachment and call is encrypted on the officer's device before it leaves. The server relays ciphertext and never holds the keys, so investigative material is never readable on a server, in a backup or by an outside provider.
File names, types and contents are encrypted with AES-256-GCM using a fresh key per file, carried inside the libsignal message.
Integrity of instructions
Every message carries an authentication code that only the two endpoints can derive, so any tampering in transit causes decryption to fail. Encrypted priority broadcasts carry their priority, deadline and expiry inside the encryption, so an instruction cannot be downgraded or replayed.
When a contact's identity key changes, every conversation they share is told to verify the safety number again before sensitive information is exchanged.
Control of every device in the field
Devices are approved before they receive anything, protected by hardware-backed keys and listed in each account's signed device list. When a phone is lost, seized or an officer leaves, administrators place it in lost mode, revoke it and remotely wipe it, and the device is excluded from every future message.
- Device approval before first use
- Lost mode, revocation and remote wipe
- Device mutual TLS
- Signed device lists
Accountable administration
Administrators sign in with FIDO2 security keys and work within permission-scoped roles. Every security and administrative action is written to a SHA-256 hash-chained audit log that can be verified on demand and exported to the agency's SIEM. Audit records never contain message content.
Technical proof
Read the detail in the SANKET whitepaper
Every statement on this page is set out in full in the public SANKET Technical Security and Architecture Whitepaper, free to read without registration.
What secure messaging app should police and law enforcement use?
Agencies need end-to-end encryption plus control of devices and infrastructure. SANKET by Tosh Defence provides Signal Protocol encryption through official libsignal, AES-256, device approval and remote wipe, and an installation the agency controls.
What happens if an officer's phone is lost or seized?
Administrators place the device in lost mode, revoke it and request a remote wipe. A revoked device is excluded from every future message and its client certificate is revoked.
Can the agency audit administrator activity?
Yes. Security and administrative events are written to a SHA-256 hash-chained audit log, recorded by Sanket ID, verifiable on demand and exportable to the agency's SIEM over TLS-protected syslog.
Do calls work on restrictive networks?
Yes. Where a network allows only outbound HTTPS on TCP 443, SANKET calls connect through that single port, and the media stays end-to-end encrypted with AES-256-GCM inside the tunnel.
Who hosts SANKET for a law-enforcement agency?
The agency chooses: a dedicated Sanket.Work installation hosted for it, or Sanket.Enterprise operated on its own premises or closed network. Every option is a dedicated installation for one organisation.
Secure your agency's operational communications
Tosh Defence works with agency technology and security teams to plan a dedicated installation, device rollout and administrator governance.