How this is built.
Not what we claim.

Signal Protocol. Double Ratchet. Forward secrecy.

Fenrir uses the Signal Protocol for end-to-end encryption — the same protocol used by Signal and trusted by security researchers worldwide. Every message is encrypted on the sender's device before it leaves. It is decrypted only on the recipient's device. The server handles an opaque ciphertext blob it cannot read.

The Double Ratchet algorithm means every message uses a different encryption key. Compromising one message does not compromise past or future messages. This property is called forward secrecy.

Sealed sender — landing this phase.

Standard encrypted messaging protects message content but still exposes metadata — who sent what to whom, and when. We're closing that gap with sealed sender: the sender's identity is encrypted inside the message payload using the recipient's identity key, so the server sees only the recipient and a timestamp — not the sender.

To be precise about where this stands: usernames are registered, and your account exists on our servers today. Sealed sender is the change that stops the server from linking a sender to a delivery at the moment a message arrives — it is the last piece closing out the current messaging-hardening phase, ahead of voice.

No phone number. No email. Username only.

Registration requires a username and password. Nothing else. No phone number, no email address, no external identity anchor of any kind. Your identity on Fenrir is your username — chosen at registration, permanent.

Passwords are hashed with bcrypt server-side. The plaintext password never leaves your device and is never stored anywhere. Account recovery is via a backup code generated locally at registration and shown once. If lost, the account cannot be recovered. This is the price of not requiring a phone number — we communicate it clearly.

Contact discovery is by username search only. We do not scan your contacts. We do not ask for your address book. There is no contact hashing. If you know someone's username, you can message them. If you do not, you cannot.

Our hardware. Our network. Our rules.

Fenrir runs on physical infrastructure owned and operated by AetherMind. No hyperscaler is in the data path. No AWS, no GCP, no Azure. The compute, storage, and networking are ours.

Today's build runs on a segmented, VLAN-based network — management traffic, VM traffic, and application traffic isolated from each other by design, default-deny between segments unless explicitly allowed. This is validated and reboot-persistent now. The full production topology — a dedicated perimeter firewall, redundant storage replication, and a fully isolated backup network — is architecture-locked and sequenced next; it is not yet the live topology.

Reaching this backend from outside our private network requires one external component: a relay, needed because our current connection sits behind CGNAT with no static public IP on-site. This relay is being brought online now, as this build phase closes. Design is locked: it will hold no user data and no encryption keys, and it will see only connection-level metadata — timing, and that a connection occurred — never content, which stays end-to-end encrypted regardless of transport. That disclosure holds permanently, not just until the relay is live: when a self-owned static IP replaces it, the relay itself goes away, but the same standard — no third party ever sees content — is what it's held to the entire time.

Self-hosted. No Google. No Apple in the data path.

Push notifications are delivered via a self-hosted UnifiedPush server. No Google FCM. No Apple APNs. No third-party service receives any information about your notification events. This works on standard Android and GrapheneOS.

Notification payloads carry zero content. They are a signal to your device to wake the app and fetch the message over the encrypted channel. The notification itself tells nothing to anyone who sees it.

What is not in this stack.

The following are absent by design. This is not marketing language — these components do not exist in the architecture.