VedaONE
Sovereign Enterprise Communications Platform
Zero-trust messaging, voice and video for defence and enterprise, using NIST post-quantum algorithms, IETF MLS group encryption and fully on-premises data residency.
- Hybrid post-quantum cryptography: ML-KEM-768 and ML-DSA-65
- IETF MLS TreeKEM (RFC 9420) group encryption at scale
- Blind push: no message content or identities sent through commercial push services
- Two-Person Integrity oversight without master keys
Overview
High-assurance collaboration needs more than end-to-end encryption: traffic recorded today could be decrypted by future quantum computers, commercial push networks see contact graphs and notification previews, and regulated organisations need lawful oversight without a single administrator holding a master key.
VedaONE is a sovereign communications platform — secure messaging, voice, video and file exchange — deployed entirely on customer infrastructure. It combines hybrid post-quantum cryptography, MLS TreeKEM group ratcheting, hardware-backed key storage on devices, a zero-plaintext push conduit, network adaptation from 5G down to 2G, geofencing, and Two-Person Integrity controls for compliance access.
Key capabilities
-
Post-quantum cryptography
Hybrid classical and quantum-resistant algorithms — ML-KEM-768 (Kyber) and ML-DSA-65 (Dilithium) — against harvest-now-decrypt-later attacks.
-
MLS TreeKEM groups
IETF RFC 9420 group ratcheting designed to scale to tens of thousands of members without O(n²) key overhead.
-
PQXDH direct messaging
Post-quantum key agreement for one-to-one conversations.
-
Zero-plaintext blind push
Commercial push (FCM) is treated as an untrusted pipe: an ephemeral sync token wakes the device, which fetches encrypted payloads over mTLS 1.3.
-
Hardware-backed device storage
On-device data encrypted with hardware security modules (Android StrongBox, Apple Secure Enclave) and biometrics.
-
Network-adaptive voice and video
Continuously probes bandwidth and loss, scaling from 5G / Wi-Fi 1080p video down to 6 kbps narrowband Opus voice on 2G.
-
Offline messaging and sync
Store-and-forward outbox in an encrypted SQLCipher database; delta sync with UUIDv7 cursors and delay-tolerant networking.
-
Encrypted SFU media mesh
Pion WebRTC selective forwarding unit relays encrypted audio and video without server-side decryption.
-
Polygon geofencing
Crossing a designated perimeter can trigger sensor quarantine (camera / microphone disable) or a cryptographic local wipe.
-
Self-healing watchdogs
Client and server watchdogs supervise signalling, ICE candidates and lock-screen states, clearing orphaned call sessions.
-
Two-Person Integrity
Shamir Secret Sharing (k=2, n=3 quorum) gates compliance decryption; no single administrator can decrypt archives.
-
Unified evidence feed
Encrypted chats, voice notes, attachments and calls in one chronological timeline with byte-range forensic playback and SHA-256 verification.
Architecture
VedaONE secures communications in four cryptographic layers — transport, application, device and compliance — managed from a sovereign control plane on customer infrastructure. The server stores only ciphertext.
-
Layer 1 · Transport
- Mutual TLS 1.3 with hybrid post-quantum key agreement
- Hardware-pinned X.509 device certificates
-
Layer 2 · Application
- PQXDH direct messaging
- IETF MLS TreeKEM (RFC 9420) groups
-
Layer 3 · On-device
- Hardware vault storage (StrongBox / Secure Enclave)
- Encrypted SQLCipher outbox
- Biometric protection
-
Layer 4 · Compliance
- Two-Person Integrity (Shamir k=2, n=3)
- Isolated compliance keys
- Signed immutable audit trail
-
Control plane
- Admin portal
- SCIM 2.0 / SAML identity
- TPM / Secure Enclave attestation
Technical specifications
| Version | VedaONE 0.1.0 (v0.1-pqc) |
|---|
| Transport handshake | X25519MLKEM768 hybrid key agreement (NIST FIPS 203 ML-KEM-768); mTLS 1.3 with hardware-bound X.509 device certificates |
|---|---|
| Signatures | ML-DSA-65 + Ed25519 (NIST FIPS 204 / RFC 8032) |
| Messaging | PQXDH for 1:1; Double Ratchet (AES-256-GCM / HKDF-SHA512); IETF MLS TreeKEM (RFC 9420) for groups |
| Payload cipher | AES-256-GCM / ChaCha20-Poly1305 |
| Device vault | SQLCipher AES-256 with Android StrongBox / Apple Secure Enclave keys and biometric binding |
| Dual control | Shamir Secret Sharing (2-of-3) Two-Person Integrity; isolated compliance-archive keys; signed audit trail |
|---|
| Components | nginx 1.26 edge (TLS 1.3, mTLS, WAF), Next.js 16 / Node.js 20+ control plane and REST API (42 routes), SCIM 2.0, Server-Sent Events |
|---|---|
| Database | PostgreSQL 17 with Prisma ORM |
| Engine | Pion WebRTC SFU with scalable video coding; Opus 6–510 kbps; VP9 / AV1 / H.264 |
|---|
| Backends | MinIO, AWS S3, Google Cloud Storage, Azure Blob, on-premises NAS/SAN, SFTP; HTTP 206 range streaming |
|---|
| Directory | SCIM 2.0, SAML, OIDC; MDM with TPM 2.0 / Secure Enclave attestation |
|---|
| Android | Kotlin, Android 9 (SDK 28) and later; StrongBox keystore |
|---|---|
| iOS (beta) | Swift / SwiftUI, iOS 16 and later; Secure Enclave, CallKit and PushKit |
| 1:1 dispatch latency | 44 ms p95 (SLO < 200 ms) Source-reported |
|---|---|
| Burst throughput | 95.1 messages/s (SLO > 50) Source-reported |
| Device registration | 281 ms for 50 devices (SLO < 500 ms) Source-reported |
| Portal initial load | 864 ms p95 (SLO < 1,500 ms) Source-reported |
Deployment
-
On-premises / State Data Centre
All communications data stays on customer infrastructure.
-
Air-gapped Source-reported
Operates without external connectivity.
Requirements
| Operating system | Linux 6.x: Debian 12+, Ubuntu 22.04+ LTS or RHEL 9+ |
|---|---|
| CPU / RAM | Minimum 4 vCPUs / 8 GiB; recommended 8–16 vCPUs / 16–32 GiB |
| Disk | 100+ GB NVMe SSD with LUKS full-disk encryption |
| Software | Node.js 20+, PostgreSQL 17, nginx 1.22+, ffmpeg, espeak-ng |
| Devices | Android 9+ handsets; iPhone with iOS 16+ (beta client) |
Supported integrations
-
SCIM 2.0 / SAML
Identity
User provisioning and single sign-on.
-
MinIO, S3, GCS, Azure, NAS / SAN, SFTP
Storage
Modular archive storage.
-
AuraVoice
VedaCLOUD.AI
Voice notes appear in the unified evidence feed.
Security & governance
-
Ciphertext-only server
Messages are encrypted with ephemeral epoch keys; the server stores only ciphertext.
-
Metadata protection
No message text, names or identifying metadata pass through commercial push services.
-
Device attestation and pinning
Hardware attestation and hardware-pinned device certificates.
-
Two-Person Integrity
Compliance access requires two of three key holders; no backdoor or master key.
-
Perimeter controls
Geofence-triggered sensor quarantine and cryptographic local database wipe.
Use cases
-
Defence
Defence and strategic communications
Quantum-resistant messaging and calls with perimeter controls for field operations.
-
Government and regulated enterprise
Sovereign enterprise collaboration
On-premises messaging, voice and video with Two-Person Integrity oversight.
-
Emergency response
Disaster-zone operations
Communications that degrade gracefully to 6 kbps voice and queue messages offline when networks fail.
Documentation & developer resources
Cryptographic Architecture
Resilience
Open the VedaONE documentation
Downloads
- VedaONE — Technical & Customer Deck
VedaONE technical and customer briefing (PowerPoint, 10 slides).
Frequently asked questions
Is VedaONE quantum-resistant?
VedaONE uses hybrid key agreement and signatures combining classical algorithms with the NIST post-quantum algorithms ML-KEM-768 and ML-DSA-65.
Can administrators read messages?
No single administrator can. Compliance decryption requires a Two-Person Integrity quorum (two of three key holders) using Shamir Secret Sharing, and every access is recorded in a signed audit trail.
Does it work on poor networks?
Yes. Calls adapt from 1080p video on 5G and Wi-Fi down to 6 kbps voice on 2G, and messages are queued in an encrypted outbox and synchronised when connectivity returns.
Items marked Source-reported are as stated in VedaCLOUD.AI product material and have not been independently verified.