Sovereign Authenticated Network Key-based Encrypted Transmission
“The signal only you can read.”
BUILT IN INDIA. DESIGNED FOR SOVEREIGN NATIONS.
Sensitive Communication Should Not Run on Apps You Do Not Control
Consumer and externally hosted apps are routinely used for sensitive operational communication. The organisation does not operate the servers, hold the keys, set the retention policy, approve the updates or own the audit trail. SANKET puts deployment, keys, administration and audit inside your own security boundary.
Customer-Controlled Data Residency
Your data stays on infrastructure you designate, under your own jurisdiction: your own servers or an approved sovereign cloud.
No Mandatory External Runtime Dependence
On-premises and air-gap builds run without mandatory external cloud services, APIs or CDNs. Air-gapped if needed.
Operational Independence
No outside party can shut down your communications or push an update you have not approved. You control the software, the servers and the encryption keys.
Built in India. Designed for Sovereign Nations.
Engineered and maintained by Tosh Defence, with documented interfaces, inspectable deployment and export paths. No black boxes.
THE PROBLEM
Armed forces, security agencies and government departments often exchange sensitive operational information over consumer and externally hosted apps: platforms they do not operate, with no organisational hierarchy and no audit trail under their own control. SANKET is designed to close that gap.
THE SOLUTION
What SANKET Does
SANKET is a sovereign secure information exchange platform for military units and high-trust organisations. It is designed for end-to-end encrypted messaging, calls, files and organisational communication, with customer-controlled deployment and administrative governance. Its encryption design uses the Signal Protocol through official libsignal bindings, with X3DH key agreement, the Double Ratchet and post-quantum last-resort pre-keys. SANKET is aligned to iDEX DISC 14, Challenge 69: Secure Information Exchange Platform for Military Units.
SANKET can run as a managed or sovereign-cloud deployment where approved, as a customer-operated on-premises deployment, or as an air-gap capable enterprise build. Infrastructure, keys and administration stay under your jurisdiction and control. SANKET is available for controlled demonstration and deployment scoping, with on-premises and air-gap builds available.
संकेत (SANKET) - Signal. Code. Indication. Covert sign. Used in military contexts for covert signals between forces. The word is communication itself: a name rooted in India, built for sovereign operators.
CAPABILITIES
Key Features
End-to-End Encryption
Signal Protocol with Perfect Forward Secrecy: every message uses a fresh key. The server is designed to hold only ciphertext and no message keys.
Organisation Hierarchy
Role-based access built around your command structure - Commander, Officer, Viewer. Not a generic enterprise org chart.
Flash Broadcast System
Four priority tiers: FLASH / IMMEDIATE / PRIORITY / ROUTINE. Mandatory read acknowledgements for critical orders. Auto-escalation if FLASH goes unread.
Classified File Vault
AES-256-GCM encrypted file sharing with sensitivity labels (Restricted / Confidential / Secret), digital watermarking, and access revocation.
Threat Monitoring Dashboard
Monitoring of failed logins, unusual access patterns and off-hours activity, with a tamper-evident audit log of administrative and security events.
Customer-Controlled Deployment
Hosted on your own servers or an approved sovereign cloud. No mandatory external runtime dependence. Auditable by your own teams at any time.
Certification Alignment Pathway
Designed with formal evaluation in mind. A recognised protocol is not a certification: alignment to your national classified-communication standards is assessed per deployment.
Offline-Capable
Message queue persists and syncs on reconnect, designed for areas with intermittent connectivity.
MULTILINGUAL SUPPORT
Available in 26 Languages
Every soldier, officer, and official uses SANKET in their own language. Full interface localisation - not just translation.
हिन्दी
Hindi
বাংলা
Bengali
தமிழ்
Tamil
తెలుగు
Telugu
मराठी
Marathi
ગુજરાતી
Gujarati
ಕನ್ನಡ
Kannada
മലയാളം
Malayalam
ਪੰਜਾਬੀ
Punjabi
ଓଡ଼ିଆ
Odia
অসমীয়া
Assamese
English
English
العربية
Arabic
Français
French
Deutsch
German
Español
Spanish
Português
Portuguese
Русский
Russian
日本語
Japanese
한국어
Korean
中文
Chinese
ไทย
Thai
Tiếng Việt
Vietnamese
Türkçe
Turkish
Nederlands
Dutch
Italiano
Italian
SECURITY ARCHITECTURE
Designed for High-Threat Environments
SANKET is built on published, peer-reviewed cryptographic protocols implemented through official libraries. A recognised protocol is not a certification: formal evaluation for a specific deployment is a separate, evidence-led process.
Protocol Implementation
libsignal
Signal Protocol through the official libsignal bindings, not a custom reimplementation
Key Agreement (1:1)
X3DH
Extended Triple Diffie-Hellman with ephemeral keys for Perfect Forward Secrecy
Post-Quantum Pre-Keys
Last-Resort PQ Pre-Keys
Post-quantum last-resort pre-keys in the key agreement design
Message Ratchet
Double Ratchet
A fresh encryption key for every message, so compromise of one key does not expose earlier messages
Message Encryption
AES-256-GCM
Authenticated encryption: tampered messages fail verification and are rejected
Group Encryption
Sender Keys
Per-group encryption chain designed to rotate when members leave
File Encryption
Double-Layer AES-256-GCM
Per-file random key plus conversation key wrapping; file names are encrypted before upload
Key Derivation
HKDF-SHA256
Conversation keys derived per group, following RFC 5869
Password Hashing
Argon2id
Memory-hard password hashing, winner of the Password Hashing Competition (RFC 9106)
Transport Security
TLS 1.3 Only
Certificate pinning: connections presenting unexpected certificates are refused
Local Database Encryption
AES-256 Encrypted
Device database encrypted at rest with hardware-derived key material where the device supports it
Private Key Storage
Hardware-Backed Keystore
Private keys held in the device's hardware-backed keystore where available
Multi-Factor Authentication
TOTP (RFC 6238)
Time-based one-time passwords as a second factor
Random Number Generation
OS-Native CSPRNG
Cryptographically secure random number generation from the operating system
Zero-Knowledge Server Design
Even with full database and storage access, the server cannot read a single message. All encryption and decryption happens exclusively on your device.
Threat Model - Who We Defend Against
Nation-State SIGINT
TLS 1.3 transport encryption plus end-to-end AES-256-GCM. The Double Ratchet provides Perfect Forward Secrecy, so past messages are designed to stay protected if current keys are compromised.
Compromised Server
Server stores ciphertext only, with no message key material and no plaintext. Routing metadata remains, so server hardening and access governance still matter.
Rogue CA / MITM Attack
Certificate pinning at the application layer: connections to servers presenting unexpected certificates are refused before data is transmitted.
Compromised Device
Private keys in the hardware-backed keystore where available and an encrypted local database. A fully compromised endpoint remains a risk that device governance must address.
Insider Threat (Server Admin)
End-to-end encryption keeps message content outside the server's trust boundary. Administrators still control accounts and devices, so administrative actions are logged for audit.
Physical Device Seizure
Hardware-backed key protection and an encrypted local database. Admin-gated device trust: a seized device can be revoked by an administrator.
Audited Cryptographic Libraries
SAG Alignment Pathway
DEPLOYMENT OPTIONS
Product Tiers
Sanket.Work
Managed or sovereign-cloud deployment where approved. Fast deployment with no infrastructure overhead, for units needing rapid operational capability.
Sanket.OnPrem
Customer-operated deployment on your own servers. Air-gap capable enterprise build with full data isolation, for facilities with the most demanding classification handling.
Sanket.Field
RoadmapField and mesh operation for disconnected forward environments. A roadmap capability, not part of the current build.
CUSTOMER CONTROL COMPARED
Why SANKET?
“Your sensitive communications should run on infrastructure you control, under your jurisdiction. SANKET is designed for exactly that.”
CLAIMS BOUNDARY
What SANKET Is, and What It Is Not
SANKET is a sovereign secure information exchange platform. Its security properties come from its design and from how it is deployed and governed, so we state both the design and its limits.
What SANKET is designed to do
- End-to-end encrypted messaging, calls, files and organisational communication
- Signal Protocol through official libsignal bindings, with X3DH, the Double Ratchet and post-quantum last-resort pre-keys
- Per-device encrypted delivery and AES-256-GCM file encryption
- TLS 1.3 transport, multi-factor authentication and administrator-approved device trust
- Customer-controlled deployment with administrative governance and an auditable backend
- On-premises and air-gap capable enterprise builds
What SANKET is not
- A generic chat app
- A replacement for tactical radio or satellite communications
- Proof that all administrator, metadata, endpoint and key-management risks are solved
- Certified merely because it uses a recognised cryptographic protocol
Technical details are confirmed against the current build and security architecture before any formal security response. Field and mesh operation is a roadmap capability. The next step is a controlled demonstration scoped to your problem and boundary.
INTEGRATION
Works With
DESIGNED FOR
Who It Serves
Built in India. Designed for Sovereign Nations.
Engineered in India for lawful deployment by sovereign nations and approved organisations. Customer-controlled infrastructure, documented interfaces and export paths, and no mandatory runtime dependence on infrastructure outside your boundary.
EXPLORE MORE
Other Mission Applications
RECORDS & COMPLIANCE INTELLIGENCEअभिलेखCommercially operatingRecordsKeeper.AI
Sovereign AI-First Records & Data Management with Intelligence Platform
AI-first records, knowledge and compliance intelligence that turns organisational records into a searchable, governed and auditable knowledge system.
Learn More
SOVEREIGN REASONING & ORCHESTRATIONप्रज्ञाAvailableTosh AI
PRAGYA intelligence and YANTRA orchestration
Sovereign AI, retrieval and agentic orchestration: the controlled reasoning and action system around replaceable models, running inside your own walls.
Learn More
ASSET READINESSसजगIn active developmentSAJAG
Smart Asset Judgement & Availability Guard
Predictive maintenance and spares-demand intelligence that estimates failure risk from historical maintenance, usage, terrain and weather data.
Learn More
INFRASTRUCTURE AWARENESSदृश्यIn active developmentDRISHYA
Defence-grade Real-time Integrated Single pane for Holistic Yield Analytics
Multi-OEM infrastructure monitoring that brings telemetry and alerts from heterogeneous network equipment into one operational picture.
Learn More
CYBER RESILIENCEमायाIn active developmentMAYA
Military Autonomous Yield-intelligence Architecture
Defensive cyber deception and incident intelligence: approved honeypots, honeytokens and canary artefacts that expose intrusions and give operators context.
Learn MoreReady to See SANKET in Action?
Start with a controlled demonstration scoped to your operational problem, security boundary and existing systems. Available to sovereign and approved organisations, subject to applicable export law.