Designed so that no one in the middle can read anything — including us
AlfaOneX was built threat model first: each security property is written down with the test that checks it, and your assessors may read the source.
End-to-end by standard
Messages and calls are encrypted with MLS (IETF RFC 9420), implemented in a Rust core shared by every platform.
Customer-hosted
Every server runs on your infrastructure. We hold no production systems, no keys and no data.
Closed enrolment
People join only by invitation. Each device receives a certificate from your own authority; there is no open sign-up.
Signed policy
What the app may do is set in a policy signed by your offline key. Servers relay it; devices verify it.
Metadata minimised
No phone numbers, no address-book upload. Servers see that a device sent something, when, and how big — not what.
Sealed on the device
Everything stored on a device is sealed under a key held by the phone's secure hardware.
How it fits together
Devices encrypt. Your servers carry ciphertext. Your root key stays offline.
Who can see what
| Who | Can see | Cannot see |
|---|---|---|
| Your servers | That a device sent something, when, and its size | Any message, call, file or location |
| AlfaOneX (us) | Nothing — we run none of your systems | Anything at all |
| Google / Apple (Connected edition only) | That a device has something waiting | What it is, or who it is from |
| Someone holding a locked phone | A lock screen | The data, which stays sealed until unlocked |
Enclosed or Connected — your choice
Both editions use the same encryption and the same servers. They differ only in whether Google's and Apple's notification services may wake the app.
Enclosed
Contains no Google or Apple services at all — verified on every build. Messages arrive over your own connection. For the most sensitive users.
Connected
Uses Google and Apple only to wake a closed app. The wake-up carries no content and no sender, and can be switched off by your policy.
Built to be examined
We assume the buyer reads the source, and we work so that they can.
- A written threat model, with the test that proves each claim
- Every dependency justified and listed with its licence
- Open standards: MLS for messages and calls, AES-256-GCM for files
- Web client that loads nothing from third parties, checked on every build
Put it in front of your security team
We will walk your assessors through the architecture, the threat model and the code.