Your server can't read your messages
Messages, files and calls are end-to-end encrypted between the members of each conversation. The server stores and relays them without the keys.
MLS · IETF RFC 9420 · OpenMLS
Self-hosted · End-to-end encrypted
Confidential conversations, on infrastructure you own.
End-to-end encrypted messaging and calls for your team, on your own server. Invisible on the Internet. Only your enrolled devices get in.
MLS · RFC 9420
UDP 51823 · silent
- MLS end-to-end encryption
- One UDP port, silent to strangers
- Hardware-bound devices
- YubiKey sign-in
- Zero telemetry
Everything a team needs
Replaces Slack or Teams for internal communication.
Channels, direct messages, files, reactions, search, presence, audio and video calls, screen sharing. On Windows, macOS and Android.
- Channels & direct messages
- Encrypted files
- On-device search
- Presence
- Audio & video calls
- Screen sharing
Audio and video calls, screen sharing, call statistics.
Messages, encrypted files, reactions, read receipts.
Android app, YubiKey over NFC.
Five pillars, each with its proof
Promises you can check.
Invisible on the Internet
One UDP port, silent to anything that isn't authenticated. No public sign-in page, no exposed API: the application services exist only inside the encrypted application tunnel, in the office and remotely alike.
UDP 51823 · the only open port
Only your devices, only your people
A device joins through a single-use enrolment link; its key is created in the security chip and can't be copied. Every sign-in then takes that device, the password and a security key.
TPM · Secure Enclave · StrongBox · YubiKey
Runs on hardware you already own
A native QNAP package: one read-only container with PostgreSQL built in, first setup in the browser, no command line. No cloud account, no third-party subscription to keep the messaging running.
QNAP QTS · Container Station
Zero telemetry, signed updates
The app talks to your server and nothing else. Every release is signed and checked independently by the server, the host and the app; devices get their updates from your own server, through the tunnel.
Ed25519 · Authenticode, timestamped
How you get in
Three proofs, or the door stays shut.
Every connection needs the device you enrolled, the password the person knows and the security key they hold. Lose any one and the door stays shut.
A single-use link (72 h by default) handed out by the administrator. The device key is created in the security chip and attested by the manufacturer; the administrator approves it with a 6-digit code compared out loud.
Without the tunnel, the server doesn't exist. Each device has its own tunnel key, renewed every 30 days, plus an additional pre-shared key.
Mutual TLS signed by the device's hardware key. The server checks that the tunnel address really belongs to that device.
Password, then a security key registered on this server (YubiKey PIN and touch). Sessions are limited (12 h by default) and lock after 15 minutes of inactivity.
MLS between the devices of the conversation's members. The server distributes them without being able to decrypt.
Each step is passed in this order. A failure at any one of them stops everything.
NyxTalk vs Slack and Teams
Their cloud, or your server.
Slack and Teams keep your conversations in their cloud. NyxTalk keeps them on your server, encrypted so that even your server can't read them.
| Criterion | Slack | Microsoft Teams | NyxTalk |
|---|---|---|---|
| Where the data lives | Slack's cloud (Salesforce) | Microsoft 365 cloud | On your server, on your premises |
| Can the provider read the messages? | Technically yes: encryption at rest and in transit, server-side; customer-managed keys (EKM) as an option on Enterprise+ | Technically yes: encrypted at rest so that the organisation can decrypt content (eDiscovery); end-to-end encryption limited to one-to-one calls and Teams Premium meetings | No: MLS end-to-end encryption for every message, file and call |
| Exposure on the Internet | Public sign-in pages and APIs | Public sign-in pages and APIs | One silent UDP port; no public page or API |
| Who can sign in | Any device with the credentials (+ two-factor, depending on settings) | Any device with the credentials (+ Conditional Access, depending on licence) | Only an enrolled device, with password and security key |
For administrators
One package, one port, one browser.
Install the QNAP package, open one port, set up everything in your browser. Revoke a lost device in one click. Signed updates for server and apps.
- Four security levels, chosen at installation
- Enrolment with approval and verification code
- Audit log and security score in the console
- Email invitations through your own SMTP
Keep your conversations where they belong.
Request a demo and we'll help you set up NyxTalk on your own infrastructure.