Tunnel Mobile

The native endpoint where operators actually work.

Tunnel Mobile supports the approved capabilities and policies of the customer's Tunnel deployment from a native mobile endpoint. Content is encrypted and decrypted on the device. Credentials belong to the device. Nothing about the operator's communication requires trusting the infrastructure that carries it.

  • Native mobile endpoint
  • Device-bound credentials
  • Endpoint-held keys
  • Offline capable

Communication

The native operator endpoint, with the complete suite.

Content is sealed on the device and credentials are bound to it. Every mode below runs under mission-scoped, expiring authority.

MODE

Secure messaging

Direct and mission-scoped exchange between authorized endpoints.

CONTROLLED EVALUATION

MODE

Secure files

Carried under the same authority and the same sealed form as a message.

CONTROLLED EVALUATION

MODE

Private voice notes

Recorded and sealed on the endpoint before anything leaves it.

CONTROLLED EVALUATION

MODE

Secure voice calls

Live voice between authorized endpoints, with relay-assisted transport.

CONTROLLED EVALUATION

MODE

Secure video calls

Live video under the same authority model as voice.

CONTROLLED EVALUATION

MODE

Mission rooms

Controlled group communication scoped to a mission, not to a permanent contact list.

CONTROLLED EVALUATION

All six modes are implemented and verified by executed tests, and all six carry the same outstanding evidence: physical acceptance of the application path, which is tracked on Assurance and is not claimed here.

DEVICE

Per-device authority

Each enrolled device is independently identified, governed and revocable.

DEVICE

Device-bound credentials

A capability copied to another device does not function there.

DEVICE

Mission-scoped authority

Authority can be constrained by mission context, relationship, capability, device and time.

DEVICE

Offline operation

Composition, queueing and local exchange with no network present.

DEVICE

Controlled provisioning

Devices enter the deployment only through the customer's enrollment authority.

DEVICE

Revocation

A device is withdrawn without disturbing the operator's other devices.

The product

What an operator actually sees.

Authentic captures from the product's own visual tests, on real hardware, against synthetic data.

Tunnel Mobile mission list showing two missions, one of them closed, each showing the operator name used inside that mission and its count of authorized contacts.
Mission-scoped authority. Authority is held per mission: the closed mission shows no authorized contacts, because closing a mission ends the authority inside it.
Tunnel Mobile authorized contacts, showing paths in authorized, expiring and revoked states with validity windows and policy epoch.
Only paths Command has authorized appear. There is no directory and no search, and each path shows its direction, validity window and epoch.
Tunnel Mobile conversation showing directional authorization and per-message delivery state.
A one-way authorization is visible in the conversation itself: the counterpart cannot reply unless Command authorizes that separately.
Tunnel Mobile conversation after revocation, with sending disabled and the reason shown.
After withdrawal the endpoint refuses to send and says why. Revocation is enforced where the content is, not only in an administrative record.

What operators get

A communication surface, not a security exercise.

The security architecture is the point, but it is not the experience. An operator opens the application and communicates; the platform enforces what the organization decided.

01

Secure messaging

End-to-end encrypted conversation, with content sealed on the device before it reaches any infrastructure.
02

Secure files and voice notes

Files and voice notes travel inside the same Secure Mission Bundle as text, under the same authorization and the same expiration policy.
03

Mission-scoped authority

Authority can be constrained by mission context, relationship, capability, device and time, rather than granted once and held everywhere.
04

Disconnected operation

Bundles are composed while offline, held on the device, and delivered when a permitted transport becomes available.
05

Controlled provisioning

Enrollment is governed by the organization. QR-controlled provisioning binds a device to an operator under the organization's authority.
06

Per-device authority

Each enrolled device is independently identified, governed and revocable. It holds its own credentials and its own authorizations.

On the device

Cryptography happens where the operator is.

Tunnel Mobile derives content keys on the endpoint. The platform's administrative components have no part in that derivation, and the relay carries the result without the means to open it.

Device-binding key
A P-256 key that proves this specific device. It is generated inside the platform's secure element where one is present, is not exportable, and authenticates the device to the deployment.
Protocol signing key
An Ed25519 key used for sender authentication on a Secure Mission Bundle. It signs; it never participates in key agreement.
Protocol agreement key
An X25519 key forming the classical half of hybrid key establishment.
Post-quantum KEM key
An ML-KEM-768 key forming the post-quantum half. No secure element on any current platform supports ML-KEM, so this key is hardware-wrapped rather than hardware-resident, and Tunnel states it that way.
Payload key
Derived on the endpoints from the agreement and encapsulation results. It exists only at the endpoints. No administrative component contributes an input to it.

Device lifecycle

A device that is lost is a device that can be withdrawn.

Because each device holds its own credentials and its own authorizations, withdrawing one device does not disturb the operator's other devices and does not require re-establishing the organization.

Device loss and revocationEach enrolled device holds its own credentials and its own authorizations. When a device is revoked in Tunnel Command, new signed state withdraws that device's authority. Connected devices apply it on receipt. A disconnected device applies it when it next receives newer signed state, or when its existing authority reaches the end of its validity window, whichever comes first. The operator's other devices are unaffected.Tunnel Commandrevocation issuedOperator device 2unaffected, retains authorityRevoked deviceauthority withdrawnDisconnected deviceapplies on next contactcredentials are per deviceno reuse on another devicebounded by validity windowA credential bound to one device does not function if it is copied to another.
Revocation is bounded rather than instantaneous: a device that is out of contact cannot apply state it has not yet received. The signed validity window bounds that exposure.

Revocation is bounded rather than instantaneous. A device that is out of contact applies withdrawal when it next receives newer signed state, or when its existing authority reaches the end of its validity window, whichever comes first.

Deployment profiles

One product family, separately governed builds.

Different deployment profiles require separately signed, configured and governed builds, because a managed deployment and a sovereign deployment are different trust domains. Externally this remains one product family: Tunnel Mobile.

  • Deployment identity is fixed at build time, not chosen at runtime.
  • A sovereign build accepts no commercial credential or endpoint.
  • Signing identity and application identity stay separate per deployment.
  • Policy distribution is signed and governed by the customer's authority.

Next step

See Tunnel Mobile in a deployment like yours.

An executive briefing walks through the operator experience, the enrollment and revocation model, and how the client behaves when the network does not.

Request an Executive Security BriefingTunnel Command