Sanket.Chat
Security Whitepaper

SANKET Technical Security & Architecture Whitepaper

The signal only you can read.

SANKET is a sovereign, self-hosted secure communications platform: end-to-end encrypted messaging, file exchange, voice and video calls and priority broadcast, built on Signal's official libsignal library and AES-256, on infrastructure the organisation owns and can run on a closed or air-gapped network. This whitepaper sets out its threat model, cryptography, key management, identity and device controls, metadata handling, deployment and assurance, including what it does not claim.

Public edition, version 2.0, 7 October 2026. Document ID TD-SNK-WP-PUB-001. Licensed under Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0).

Start readingDownload PDFView on GitHub
Edition
Public edition 2.0
Document ID
TD-SNK-WP-PUB-001
Licence
CC BY-ND 4.0

Contents

Fifty chapters and ten appendices, free to read online. Each chapter stands on its own.

The problem, the threat model and the design principles

  1. 1Executive Summary
  2. 2Release Baseline and Capability Status
  3. 3Who SANKET Is For
  4. 4Sovereignty as a Security Control
  5. 5Threat Model
  6. 6Security Architecture Principles
  7. 7System Architecture

Architecture, cryptography, identity and the lifecycle of information

  1. 8Service Architecture
  2. 9Data Architecture
  3. 10Cryptographic Architecture
  4. 11Key Management Architecture
  5. 12Forward Secrecy and Post-Compromise Security
  6. 13Identity and Authentication
  7. 14Device Trust Model
  8. 15Role and Policy Architecture
  9. 16Zero Trust Architecture
  10. 17Message Security Lifecycle
  11. 18File Security Lifecycle
  12. 19Secure Voice and Video
  13. 20Metadata Security

Deployment, operations and assurance

  1. 21Audit Architecture
  2. 22Monitoring, Threat Detection and Observability
  3. 23Air-Gapped Deployment
  4. 24Offline-First Operation
  5. 25Network Architecture and Segmentation
  6. 26PKI Architecture
  7. 27Administrative Security
  8. 28Security Impact of Server Compromise
  9. 29Endpoint Compromise Analysis
  10. 30Software Supply Chain and Secure Updates
  11. 31Offline Licensing
  12. 32Availability, High Availability and Disaster Recovery
  13. 33Hardware Security
  14. 34Security Control Matrix
  15. 35Defensive Attack Scenarios
  16. 36Deployment Mode Comparison
  17. 37Feature Catalogue
  18. 38Information Classification Support
  19. 39Crypto-Agility and Post-Quantum Readiness
  20. 40Cryptographic Certification Roadmap

Compliance, privacy, comparison and technical FAQ

  1. 41Compliance, Assurance and Security Testing
  2. 42Secure Deployment Baseline
  3. 43External Dependency Analysis
  4. 44Privacy Architecture
  5. 45Security and Usability Trade-offs
  6. 46What SANKET Does Not Claim
  7. 47Why Air-Gapped SANKET Is Structurally Different
  8. 48Comparative Architecture
  9. 49SANKET within the Tosh Defence Ecosystem
  10. 50Technical FAQ

Appendices

  1. Appendix ACryptographic Algorithm Reference
  2. Appendix BKey Hierarchy
  3. Appendix CSecurity Control Matrix
  4. Appendix DThreat Model Summary
  5. Appendix EDeployment Reference Architectures
  6. Appendix FAir-Gap Deployment Checklist
  7. Appendix GSecurity Hardening Checklist
  8. Appendix HNetwork and Protocol Categories
  9. Appendix IGlossary
  10. Appendix JStandards and References

Evaluating SANKET for your organisation?

Talk to Tosh Defence about a technical briefing, a deployment plan for your infrastructure, or the controlled edition of this whitepaper under a non-disclosure agreement.

Contact Tosh DefenceExplore Sanket.Enterprise