Capabilities
The complete mission communication lifecycle, governed as one system.
Tunnel Sovereign combines communication, identity, authority, degraded-network operation and sovereign infrastructure in one platform. Tunnel Mobile carries the operator surface, Tunnel Command governs authority, and Tunnel Relay carries sealed traffic it cannot open.
- Communication
- Authority
- Continuity
- Protected material
- Governance
- Sovereign infrastructure
01 · Communication
A complete communication suite, sealed on the endpoint.
Every mode below is protected the same way: content is sealed on an authorized endpoint before it reaches any infrastructure, and the payload key is derived only on the endpoints.
MODE
Secure messaging
Direct and mission-scoped exchange between authorized endpoints.
CONTROLLED EVALUATION
MODE
Secure files
Carried under the same authority and the same sealed form as a message.
CONTROLLED EVALUATION
MODE
Private voice notes
Recorded and sealed on the endpoint before anything leaves it.
CONTROLLED EVALUATION
MODE
Secure voice calls
Live voice between authorized endpoints, with relay-assisted transport.
CONTROLLED EVALUATION
MODE
Secure video calls
Live video under the same authority model as voice.
CONTROLLED EVALUATION
MODE
Mission rooms
Controlled group communication scoped to a mission, not to a permanent contact list.
CONTROLLED EVALUATION
All six modes are implemented and verified by executed tests, and all six carry the same outstanding evidence: physical acceptance of the application path, which is tracked on Assurance and is not claimed here.
MODE
Capability-scoped communication
Authority is issued for a capability. Permission to message is not permission to call.
Delivery state
What a sender is told, and what the system will not claim.
An operator sees what is actually known about a message. Two states a reader will expect are deliberately absent.
STATE
Not sent
Refused on the device before any key was derived. Nothing left the endpoint.
STATE
Collected
The recipient's device fetched it. This is not evidence that a person saw it.
STATE
Accepted by recipient
The recipient's device verified and accepted it. This is the strongest statement the system makes.
There is no state for delivered and none for read. Infrastructure holding ciphertext has not handed anything to a person, and reporting that a recipient displayed something would create a behavioral signal about that person which this system declines to produce. No read receipt exists anywhere in the platform.
03 · Operational continuity
Designed for links that are intermittent, contested or absent.
Communication is protected as a Secure Mission Bundle: a transport-independent encrypted package carrying its own authorization, policy and expiration. It crosses a network or a physical carry without changing form.
Tunnel Sovereign binds authority to the mission object rather than to the network carrying it. A Secure Mission Bundle moves across connected or disconnected transport paths, and the receiving endpoint still evaluates the applicable device, mission, relationship, capability and time-bound authority before the material can be used. A transport delivers bytes; it never grants the right to read them.
CONDITION
Connected
Ordinary operation. Material is handed to custody as it is composed.
CONDITION
Intermittent
Held on the device until a permitted transport appears, and re-checked against authority before it moves.
CONDITION
Disconnected
Work continues with no network at all. Nothing waits on connectivity to be composed.
CONDITION
Offline composition
Messages, files and voice notes are created and sealed with no link present.
CONDITION
Queued authority re-check
Queued material stays in the application's private storage on the device and is re-evaluated against current authority before it is transmitted. Authority withdrawn while material is queued is not restored by a later grant. Material queued at a relay is ciphertext.
CONDITION
Store-carry-forward
Material is carried and handed on when a permitted route appears.
CONDITION
Local exchange
Short-range device-to-device transfer where no network exists.
CONDITION
Physical carry
Controlled transfer by hand across an isolated boundary.
CONDITION
Priority
A constrained link carries what matters first rather than what arrived first.
CONDITION
Controlled refusal
Material collected after its validity window closes is refused rather than carried late.
Queued material survives device restart, and outstanding work is re-enrolled when the device boots. Delivery completes when an operator next opens Tunnel.
04 · Protected material at rest
Mission material sealed on the device, not on a server.
Sensitive mission material held on the endpoint is sealed under a key hierarchy bound to the device, the mission and a local authentication factor. The server never holds the key, and a local secret alone is not enough to open it.
PROPERTY
Sealed on the endpoint
Material is sealed on the device it belongs to. No server-side copy of the sealing key exists.
PROPERTY
Bound key hierarchy
The sealing key is derived from a hierarchy bound to the device, the mission and a local authentication factor together.
PROPERTY
Hardware-backed outer wrap
On supported hardware the outer wrap is hardware-backed, using StrongBox where the platform provides it. Where it does not, the class is stated rather than assumed.
PROPERTY
Authority-gated unlock
Unlock is gated by valid mission authority. A local secret on its own is not sufficient to open sealed material.
PROPERTY
Blocked under duress
A duress condition blocks unlock rather than proceeding. The material stays sealed.
PROPERTY
Tamper fails closed
Stored material that has been tampered with fails closed. It is refused rather than opened.
The server never holds the key. Sealed material on a captured device is not opened by possession of the device alone.
05 · Governance
Command governs what is authorized, not what was said.
Administration is a separate surface with separate roles. It issues and withdraws authority, and it holds no key that can decrypt mission content.
FUNCTION
Mission administration
Missions are created, governed and closed as first-class objects.
FUNCTION
Device administration
Devices are enrolled, issued a certificate, replaced and withdrawn.
FUNCTION
Directional relationships
Each authorized path is issued explicitly, in one direction, and listed as such.
FUNCTION
Capability administration
Messaging, files, voice and video are authorized separately.
FUNCTION
Preview before issuance
An operator sees exactly what an authorization will permit before it is signed.
FUNCTION
Policy
Policy is set by the customer and distributed under signature.
FUNCTION
Revocation
Withdrawal takes effect when the device receives newer signed state, or at expiry, whichever is first.
FUNCTION
Audit
Administrative actions are recorded. The record carries no message content.
FUNCTION
Role separation
Administration and audit are held by different people, enforced rather than advised.
FUNCTION
Signed distribution
Software and policy reach devices under signature.
The authority that permits communication does not possess the keys required to decrypt communication.
Emergency authority
Authority can be finite, frozen, or withdrawn under pressure.
Revocation withdraws a device. Alongside it, authority carries limits and emergency controls that take effect on the device itself, so that a lost link is not a lost control.
CONTROL
Duress
A local action seals access and emits a signed, tamper-evident notice, without a server round-trip.
CONTROL
Scoped kill
A device or mission can be taken out of use on a defined scope rather than all at once.
CONTROL
Mission freeze
Authority is finite. When a mission is frozen, operations stop on the device with no network needed.
CONTROL
Lease expiry
When a lease expires, operations stop on the device on their own. Nothing has to reach it to end them.
CONTROL
Threshold authorization
The highest-impact revocations can require multiple distinct officers, an M-of-N approval, rather than a single administrator.
CONTROL
Control bundle over QR or file
A signed control instruction, a renewal or a revocation, can be delivered by QR code or file when there is no network.
A revocation still has to reach a device to be applied to it. A physically disconnected device applies newer signed state only when it next receives it, or its authority reaches the end of its validity window, whichever comes first. Tunnel does not claim that a remote instruction reaches a disconnected device on its own.
06 · Sovereign infrastructure
Infrastructure and authority under customer control.
Managed and Sovereign are trust postures, separated at build and deployment time rather than by runtime configuration.
OPTION
Managed Deployment
Tunnel-operated infrastructure with defined operational controls. Message content stays sealed end to end.
OPTION
Sovereign Deployment
The customer operates the infrastructure and holds the enrollment authority.
OPTION
Private cloud
Installation inside customer-governed cloud infrastructure.
OPTION
On-premises
Installation inside customer-operated facilities.
OPTION
Isolated and air-gapped
Installation with no route to a public network, updated through controlled transfer.
OPTION
Customer-held enrollment authority
The organization decides which devices exist in its deployment.
OPTION
Customer-held cryptographic roots
Root material is held by the customer under the customer's own procedure.
OPTION
HSM integration
Authority custody sits behind a provider boundary a hardware security module can implement.
OPTION
Customer-controlled audit and retention
The audit domain, its retention and its access belong to the customer.
OPTION
Signed offline updates
Updates are verified under signature and can be applied without a network path.
07 · Platform coverage
Four components, native where operators work.
One platform. The components share an authority model and a bundle format.
COMPONENT
Tunnel Mobile
The operator endpoint, built native for mobile.
COMPONENT
Tunnel Command
The authority environment, built native for desktop.
COMPONENT
Tunnel Relay
Customer-held delivery infrastructure on Linux, private cloud, on-premises or isolated.
COMPONENT
Secure Core
The shared foundation, resident in Mobile, Command and Relay.
Transport
Carried over whatever the environment provides.
The same sealed package crosses each of these without changing form.
TRANSPORT
Internet
Encrypted carriage over IP.
Carried today
TRANSPORT
Private IP
The same carriage over a customer-controlled network.
Carried today
TRANSPORT
SATCOM
Constrained, intermittent, high-latency carriage.
Partner integration, not delivered
TRANSPORT
Tactical radio
Narrowband carriage supplied by qualified radio hardware.
Partner integration, not delivered
TRANSPORT
Local device link
Short-range exchange between two devices.
Partner integration, not delivered
TRANSPORT
Physical carry
Store-carry-forward of a sealed bundle with no link at all.
Verified in the reference engine
TRANSPORT
Air-gapped environment
Controlled transfer into and out of a disconnected domain.
Deployment-specific integration and acceptance
Bundles are carried over IP today. Satellite, tactical radio and short-range links are modeled against the bundle format and the relay queue, for latency, bandwidth, MTU, frame loss and availability windows, so that behavior under a constrained link is measured before hardware arrives. A modeled link is not an integrated one, and field integration is a partner engagement that has not been delivered.
Tunnel governs communication above the transport layer. Radio performance, waveform protection, anti-jamming and low-probability-of-intercept properties remain the responsibility of the qualified transport system.
08 · Security boundary
Where each capability stops.
Each property is published with the limit that qualifies it, so an evaluator can check the limit rather than discover it.
LIMIT
Endpoint compromise
Device compromise is contained through device-specific credentials and revocation. An adversary holding an unlocked device with content on screen has defeated the cryptography.
LIMIT
Revocation timing
Withdrawal takes effect when the device receives newer signed state, or at expiry. A disconnected device cannot apply state it has not received.
LIMIT
Network observability
Source address, timing, size and session continuity remain observable at the network layer. No claim of anonymity is made anywhere.
LIMIT
Key protection
Protection class is stated per platform, per algorithm and per security level. There is no blanket hardware-backed claim.
LIMIT
Post-quantum scope
Key establishment is hybrid, combining ML-KEM-768 with X25519. Signature authentication remains classical.
LIMIT
Transport properties
Radio, satellite and waveform behavior belong to the qualified transport system, not to Tunnel.
Product configurations, integrations and operational capabilities are delivered according to customer requirements, deployment environment, validation scope and applicable authorization.
09 · Next step
Review the platform against your own environment.
An executive briefing covers the trust model, the deployment boundary and the evidence behind each capability, with an engineer present.