Self-hosted secure messaging on the Signal Protocol
SANKET (Sanket.Chat) by Tosh Defence is a self-hosted secure messaging platform built on Signal's official, independently audited libsignal: organisations run their own on-premise messaging server with Signal Protocol end-to-end encryption, post-quantum key agreement and AES-256. Every installation is dedicated to one organisation and runs on infrastructure it owns, from its own cloud account to a fully air-gapped network.
The Signal app runs on Signal's own service. SANKET gives organisations the same audited protocol library on an installation they own, administer and update on their own schedule, with the identity, device and audit controls an organisation needs.
The Signal Protocol, on your own server
SANKET uses Signal's official libsignal library for all message encryption, at the same release on every platform. It contains no reimplementation of the Signal Protocol and no alternative message cipher, so the cryptography your evaluators review is the library Signal itself publishes and that has been independently audited.
Sessions start with PQXDH and continue with the Double Ratchet and Signal's Sparse Post-Quantum Ratchet, a combination Signal calls the Triple Ratchet. Each message gets its own key, which is deleted after use.
Everything an organisation needs around the protocol
A protocol is not a platform. SANKET adds what organisations need to run secure messaging themselves: an administration console, directory provisioning, device approval and revocation, classification labels, retention policy, audit, backups and signed releases.
- Administrator FIDO2 security keys
- SCIM 2.0 and directory integration
- Signed device lists and device mutual TLS
- Hash-chained audit log with SIEM export
- Encrypted, signed backups
- Configurable retention
Your servers, your keys, your schedule
Users' private keys are generated and kept on their devices. Server-side secrets are held inside the installation, never by Tosh Defence. Releases arrive as signed packages with a software bill of materials, verified before they are loaded and installed only when the organisation's change authority approves.
Licences are verified locally from a signed file, so the service never stops because a vendor server is unreachable.
From cloud to air-gap
A self-hosted SANKET installation can run on a cloud account the organisation chooses, in its own data centre or on a network with no internet connection at all. Single-host and multi-host high-availability profiles are available in every mode.
Technical proof
Read the detail in the SANKET whitepaper
Every statement on this page is set out in full in the public SANKET Technical Security and Architecture Whitepaper, free to read without registration.
Can I self-host a Signal Protocol messaging server?
Yes. SANKET by Tosh Defence is a self-hosted messaging platform built on Signal's official libsignal library. Your organisation runs the server on its own infrastructure, with Signal Protocol end-to-end encryption, post-quantum PQXDH and AES-256.
Is SANKET a fork of Signal?
No. SANKET is its own platform that uses Signal's official, unmodified libsignal library for all message encryption. It contains no reimplementation of the Signal Protocol.
What does self-hosted mean for SANKET?
One dedicated installation per organisation, run on servers it chooses: its own cloud account, its own data centre or a closed network. The organisation controls identities, devices, policies, retention, updates and audit.
Does a self-hosted server weaken end-to-end encryption?
No. The server relays ciphertext and never holds the keys to messages, files, calls, reactions or encrypted broadcasts, so even the organisation's own servers cannot read content.
How are updates delivered to a self-hosted installation?
As signed release packages, verified before loading, installed when the organisation approves and rolled back automatically if the new version is not healthy. Expired or older releases are refused.
Is there an on-premise secure messaging option with desktop apps?
Yes. Sanket.Enterprise is operated on the organisation's own premises or closed network, with native apps for iOS, Android, Windows, macOS and Linux distributed through the organisation.
Run the Signal Protocol on infrastructure you own
Talk to Tosh Defence about a self-hosted SANKET installation: topology, identity integration, rollout and evaluation.