Chapter 37
Feature Catalogue
SANKET Technical Security & Architecture Whitepaper. Public edition 2.0, 7 October 2026.
Each capability is described by what it does, how it works, its security value, the options available to administrators, and its boundaries.
Table 60: Feature catalogue
| Feature | What it does | How it works | Security value | Configuration options | Boundaries |
|---|---|---|---|---|---|
| Secure direct communication | One-to-one messaging between users | libsignal PQXDH and Triple Ratchet, one ciphertext per recipient device, content in a versioned envelope | Content readable only by the participants' devices | Read receipts, typing, edit, delete-for-everyone, disappearing messages | Replies, reactions, locations, contacts, link previews and forwards inside the ciphertext; sender, recipient devices, time and size band visible to the server (Chapter 20) |
| Secure group communication | Multi-member conversations | Pairwise libsignal fan-out to every member device | No group key to steal; removal is immediate for future messages | Creation permission, member approval (default on), size limit (default 1,024), renaming, leaving | Cost scales with members times devices |
| Encrypted priority broadcast | Priority messages from a dedicated broadcast-sender account to all users, a role or a custom list | Sent from the account's approved desktop, which encrypts for every recipient device with per-device libsignal sessions in a resumable job; four priority levels (normal, important, urgent, critical) with full-screen flash display on mobile; priority, deadline, sent time and expiry also inside the encrypted envelope; attachments encrypted once with a per-file key carried in each copy; recipients pin the sending device and identity | Server cannot read, downgrade, move or replay a broadcast; lock-screen text generic by priority | Audience, priority, mandatory expiry, acknowledgement deadline (1 minute to 7 days, default 30 minutes, counted from the end of the fan-out); sender accounts created, assigned to named administrators and suspended in the console | Immediate only (no scheduling) |
| Notice broadcast | Non-sensitive administrator announcements | Sent from the administration console; scheduled notices are sent by the platform scheduler within a minute of their time, under the same licence and rate checks as an immediate send, and never once expired, a day overdue or after their creator has left | Simple organisational notification | Audience, priority, schedule, acknowledgement deadline, retention (90 days by default) | Server-readable by design; labelled "Notice (not end-to-end encrypted)" to sender and recipients |
| Acknowledgement tracking | Shows who has received and acknowledged a broadcast | Per-recipient delivered and acknowledged records kept as metadata; an urgent or critical broadcast still unacknowledged at its deadline is re-notified once to each recipient who has not acknowledged and raises an administrator alert with the counts | Confirms receipt of critical notices | Deadline per broadcast | Recipients must open the app |
| Voice and video calls | One-to-one and group calls | Self-hosted SFU; AES-256-GCM frame encryption plus AES-256-GCM SRTP; a server-issued id per call binds its frame keys (Chapter 19) | Media not readable by the server | Voice, video and group calls toggles; duration and participant limits; per-user call rates; TURN relay | UDP media preferred; TCP 443 with TURN over TLS where UDP is blocked |
| Encrypted file exchange | Documents, images, video, voice notes, contacts and locations | Per-file AES-256-GCM, key inside the libsignal message | Files opaque to the server | Per-source enablement, size and type limits, download-to-device (off by default), export | Recipients control copies they have legitimately obtained |
| Local secure vault | Per-device index of received attachments | Encrypted under the local cache key; access logged locally | Organised access to files without a server repository | None | Per device; not synchronised |
| Encrypted identity backup | Optional account recovery | PBKDF2 and AES-256-GCM vault with password and recovery code | Recovery after device loss | Enable or disable by policy and licence | Identity key leaves the device in encrypted form |
| Message expiry | Disappearing messages | Server deletion at expiry plus device purge | Limits retained history | Allow, force, tenant default duration (30 seconds, 5 minutes, 1 hour, 8 hours, 24 hours, 7 days or 30 days), which is a ceiling when forced (the shorter of it and the user duration applies); user durations of 1 hour, 6 hours, 1 day, 7, 30, 45 or 90 days; one duration table shared by server, mobile and desktop, so every option sets the expiry it names | Recipients can capture content before expiry |
| File expiry | Lifecycle expiry of stored objects | Object-storage lifecycle rule (90 days) | Limits server-side retention | Retention windows | Does not remove recipients' copies |
| Delivery and read acknowledgements | Receipts | Server-side state | Operational assurance | Tenant and user settings | Metadata |
| Offline queue | Messages composed offline | Encrypted local outbox (7 days); idempotent retries with the same retry classification on mobile and desktop | No loss or duplication | None | Text messages, attachments and voice notes |
| Forwarding controls | Restricts forwarding | Client-side policy (forwarding off by default) | Reduces casual redistribution | Policy | Client-enforced only |
| Screenshot restrictions | Blocks or detects screen capture | Android secure flag and iOS protected rendering; in-chat screenshot alerts; desktop content protection | Deters capture | Configurable; detection policy | Cannot stop an external camera |
| Watermarking | Visible identity overlay | Desktop and mobile file viewer overlay of Sanket ID or name | Deterrence and attribution | Configurable; content choice | Visible only; forensic watermarking on the roadmap |
| Classification labels | Marks messages and attachments with a customer-defined label | Ranked list of up to eight labels and a default; the label travels inside the end-to-end encrypted envelope; content above the lowest rank cannot be forwarded, exported or downloaded on mobile or desktop, including the desktop secure viewer; unknown labels treated as the highest rank; a forward never lowers a label | Handling rules the server cannot read or alter | Label names and ranks; default label; copy governed by the clipboard policy | Client-enforced; conversation-level labels on the roadmap; installation separation between accredited levels (Chapter 38) |
| Device governance | Approve, revoke, lost mode, locate, remote wipe, duress | Server-enforced device states; confirmed wipe; device client certificates; hardware-backed keys with a recorded protection level; offline Android Key Attestation | Containment of lost or seized devices | Policy and licence gates; required protection level; device mutual TLS enforcement | Offline devices act on revocation when they reconnect |
| Signed device lists | Lets senders verify every account's devices | Each account's device list signed with its list key on the primary device; append-only log on the installation; senders verify before encrypting on every fan-out path | A hostile server cannot add a device that receives copies | None | Trust on first use for a new identity, verified by safety-number comparison |
| MFA | Second factor: TOTP for users; FIDO2 security keys for administrators | RFC 6238 with SHA-256; WebAuthn (ES256 or EdDSA, user verification required, synced passkeys refused by default) | Credential theft resistance; phishing resistance for administrators | Second-factor enforcement configurable per installation; security keys required for administrators by default | User TOTP is not phishing-resistant |
| Federated sign-in | Administrator sign-in through the customer's identity provider; directory check for users at enrolment | OIDC with PKCE or SP-initiated SAML 2.0 for the console; LDAP over TLS at enrolment, restore and new-device sign-in | One identity source under the customer's control | Provider settings, group-to-role map (never owner) | First factor only; public providers refused |
| Session management | Device-bound sessions | Short access tokens; single-use refresh; reuse detection; idle-device revocation | Theft and replay resistance | Token lifetimes (operator); idle-device periods | - |
| Administrator console | Users, devices, policy, broadcasts, monitors, audit, integrations | Permission-scoped roles | Governed administration | Roles | No dual control |
| Threat monitoring | Lockout, limits, blocks, alerts feed, optional processor | Rule-based | Detection of common attacks | Thresholds | SIEM correlation recommended |
| Audit and reporting | Hash-chained audit; CSV export; syslog; API; webhooks | Chapter 21 | Accountability and SIEM integration | Export enablement | External anchoring through SIEM export |
| Directory provisioning | SCIM 2.0 Users; Integration API | Scoped credentials | Joiner-mover-leaver automation | Client scopes, expiry, CIDR allowlist | No just-in-time account creation from sign-in |
| Managed configuration (MDM) | Policy delivered by MDM | iOS Managed App Configuration; Android managed configurations; tighten-only | Fleet-level enforcement | Passcode, lock timeout, biometrics, wipe threshold, expected tenant | Requires an MDM |
| Usage analytics | First-party usage counts | A processor on the installation aggregates pseudonymous counts; no content; no third party | Operational insight without telemetry leaving the installation | On by default; organisation switch (step-up, audited); installation lock; delete all collected analytics | Audit logs and app-version records are not analytics and stay on |
Roadmap capabilities include sealed sender, conversation-level classification labels, per-share file revocation, forensic watermarking and push-to-talk. Server-side call recording is deliberately excluded by design.
Evaluating SANKET for your organisation?
Talk to Tosh Defence about a technical briefing, a deployment plan for your infrastructure, or the controlled edition of this whitepaper under a non-disclosure agreement.