Executive Summary

SANKET is a sovereign secure information exchange platform. It gives an organisation end-to-end encrypted messaging, file exchange, voice and video, and priority broadcast with acknowledgement, on infrastructure that the organisation owns, operates and can disconnect from the public internet.

1.1 The Sovereign Communications Problem

High-trust organisations increasingly depend on instant communications for operational decisions. Most of that traffic runs on services that the organisation neither owns nor controls. Encryption is now common in those services, but encryption on its own answers only one question: whether a third party on the network can read a message. It does not answer the questions that matter most to a defence ministry, an intelligence service or a critical infrastructure operator:

• Jurisdiction. Which government can compel the service provider to hand over data, change the software or stop the service?
• Operational dependency. Does the service keep working if the provider is unreachable, sanctioned, compromised or simply decides to change its terms?
• Telemetry and analytics. What does the software report back to its vendor, and to which third-party analytics, crash-reporting or advertising services?
• Metadata. Even when content is encrypted, who can see who talked to whom, when, from where and how often?
• Cloud dependency. Are content, keys, logs or backups held in infrastructure the organisation cannot inspect?
• Disconnected operation. Can the system run on a closed network, in an enclave or at a site without internet access?
• Administrator compromise. If an administrator account, or the vendor's own staff, is compromised, what can the attacker read or change?
• Endpoint compromise. What protection remains when a phone is lost, seized or infected?
• Software supply chain. How does the organisation know that an update is genuine, and who decides when it is installed?
• Ownership. Who owns the infrastructure, the keys, the identities and the audit trail?

A platform that encrypts content but leaves these questions to a foreign provider leaves the most valuable information about an organisation, its structure, its tempo and its relationships, outside its control.

1.2 The SANKET Proposition

SANKET is designed so that every one of those questions has an answer that sits inside the customer's own security boundary. Its security rests on six reinforcing properties:

Table 1: The six properties of the SANKET security proposition

Sovereignty + Cryptography + Identity + Isolation + Auditability + Operational Control

No single property is sufficient. Strong cryptography on a vendor-operated service still leaves jurisdiction and metadata exposure. A self-hosted service with weak identity controls still lets an attacker sign in. SANKET's position is that the combination is what produces a defensible security posture, and the rest of this document examines each part on its merits.

1.3 What This Document Establishes

• A threat model covering twenty-three threat actors, from passive network observers to a malicious system administrator and a compromised update package (Chapter 5).
• An end-to-end account of how messages, files and calls are encrypted, which keys exist, where each is generated and held, and what each protects (Chapters 10 to 12 and 19).
• A precise inventory of the metadata the server necessarily handles, and why (Chapter 20).
• An analysis of the effect of a server or endpoint compromise, and why compromise of the server yields no message content (Chapters 28 and 29).
• Reference architectures for single-site, segmented, air-gapped and resilient deployments, with the parts that are implemented separated from the parts that are recommended or planned (Chapters 23 to 26 and 32).
• An explicit statement of what SANKET does not claim (Chapter 46).