The complete mission communication lifecycle, governed as one system.

Secure messaging

Direct and mission-scoped exchange between authorized endpoints.

Secure files

File exchange carried under the same authority and the same sealed form as a message.

Private voice notes

Recorded on the endpoint and sealed before it leaves the device.

Secure voice calls

Live voice between authorized endpoints, with relay-assisted transport.

Secure video calls

Live video under the same authority model as voice.

Mission rooms

Controlled group communication scoped to a mission rather than to a permanent contact list.

Capability-scoped communication

Authority is issued for a capability. Permission to message is not permission to call.

Customer-controlled enrollment

The deployment trusts the devices its own enrollment authority admits, and nothing else.

Device-bound credentials

Credentials are specific to one device. A capability copied elsewhere does not function there.

Endpoint-generated private keys

Private key material is generated on the endpoint and stays there.

Mission-scoped identity

An operator holds a separate pseudonym in each mission. It exists only inside that mission.

Directional pairwise authorization

One authorization permits one direction between two parties. A reply needs its own.

Compartmented relationships

Each device learns only its own edges. No endpoint holds the mission topology.

Capability-scoped authority

Authority names what may be done, not merely who may be reached.

Time-limited authority

Every authorization carries a signed validity window and expires on its own.

Revocation

A device is withdrawn independently of the operator's other devices.

Multi-device security

Each device is trusted separately, enrolled separately and withdrawn separately.

Connected

Ordinary operation. Material is handed to custody as it is composed.

Intermittent

Held on the device until a permitted transport appears. Interrupted transfers resume.

Disconnected

Work continues with no network at all. Nothing waits on connectivity to be composed.

Offline composition

Messages, files and voice notes are created and sealed with no link present.

Encrypted queueing

Queued material is held sealed. It is never staged in the clear.

Store-carry-forward

Material is carried and handed on when a permitted route appears.

Local exchange

Short-range device-to-device transfer where no network exists.

Physical carry

Controlled transfer by hand across an isolated boundary.

Priority

A constrained link carries what matters first rather than what arrived first.

Controlled refusal

Material collected after its validity window closes is refused rather than carried late.

Mission administration

Missions are created, governed and closed as first-class objects.

Device administration

Devices are enrolled, certified, replaced and withdrawn.

Directional relationships

Each authorized path is issued explicitly, in one direction, and listed as such.

Capability administration

Messaging, files, voice and video are authorized separately.

Preview before issuance

An operator sees exactly what an authorization will permit before it is signed.

Policy

Policy is set by the customer and distributed under signature.

Revocation

Withdrawal takes effect when the device receives newer signed state, or at expiry, whichever is first.

Audit

Administrative actions are recorded. The record carries no message content.

Role separation

Administration and audit are held by different people, enforced rather than advised.

Signed distribution

Software and policy reach devices under signature.

Managed Deployment

Tunnel-operated infrastructure with defined operational controls. Message content stays sealed end to end.

Sovereign Deployment

The customer operates the infrastructure and holds the enrollment authority.

Private cloud

Installation inside customer-governed cloud infrastructure.

On-premises

Installation inside customer-operated facilities.

Isolated and air-gapped

Installation with no route to a public network, updated through controlled transfer.

Customer-held enrollment authority

The organization decides which devices exist in its deployment.

Customer-held cryptographic roots

Root material is held by the customer under the customer's own procedure.

HSM integration

Authority custody sits behind a provider boundary a hardware security module can implement.

Customer-controlled audit and retention

The audit domain, its retention and its access belong to the customer.

Signed offline updates

Updates are verified under signature and can be applied without a network path.

Tunnel Mobile

Native Android and native iOS.

Tunnel Command

Native Windows and native macOS.

Tunnel Relay

Linux, private cloud, on-premises and isolated infrastructure.

Endpoint compromise

Device compromise is contained through device-specific credentials and revocation. An adversary holding an unlocked device with content on screen has defeated the cryptography.

Revocation timing

Withdrawal takes effect when the device receives newer signed state, or at expiry. A disconnected device cannot apply state it has not received.

Network observability

Source address, timing, size and session continuity remain observable at the network layer. No claim of anonymity is made anywhere.

Key protection

Protection class is stated per platform, per algorithm and per security level. There is no blanket hardware-backed claim.

Post-quantum scope

Key establishment is hybrid, combining ML-KEM-768 with X25519. Signature authentication remains classical.

Transport properties

Radio, satellite and waveform behavior belong to the qualified transport system, not to Tunnel.