Sovereign secure messaging
Amana is the messaging platform built for the people entrusted with decisions that matter. It runs entirely on infrastructure you own, governed entirely by laws you wrote.
Designed for ministries, military commands, and central banks. No foreign cloud. No third parties. No exceptions.
Cabinet · secure thread
End-to-end · expires in 24 hours
Draft is ready for review. Expires after tomorrow's briefing.
09:39
Received. Will read tonight.
09:40 ✓✓
Built for the institutions that don't get second chances
Why we built this
Consumer apps are built for a different world. For the institutions that protect a country, three concerns are not accidents of policy. They are the shape of the product.
Every consumer messenger runs on a cloud governed by a foreign legal regime. Quiet subpoenas, lawful-access orders, future laws. Your data answers to a court that is not yours. Amana removes the dependency. The servers are yours. The jurisdiction is yours.
Account recovery, cloud backup, lawful-access proposals. Each puts a key in a third hand. Amana has none of these. The keys live on the devices in the conversation. If a device is lost, those messages are gone. The cost is irrecoverable history. The benefit is non-negotiable confidentiality.
App-store updates are a side-channel into your fleet. They ship code your team did not approve, to devices you cannot easily roll back. Amana is a binary you accept on your timeline, built reproducibly. Air-gapped sites deploy from the same artefact, signed by your own authority.
What it does
Everything your team expects from a modern messenger: direct chats and groups, voice and video, files and voice notes, full-text search. Running on infrastructure you control.
Not us. Not your administrator. Not a foreign cloud.
Keys live on the devices in the conversation. Nothing carries them out.
Voice and video, one-to-one and groups. Answer from the lock screen.
Media flows directly between devices, or through a relay you operate. Never a relay that listens.
Some deployments will never see public DNS. The app does not notice.
Air-gapped, flat LAN, or internet-connected. The same product, deployed where you need it.
Nobody enrols a device on your behalf. Not even an administrator.
Device approval is a visible, auditable event. There is no quiet route in.
Per-conversation timer, set by either party. Enforced on every device that received it.
Expiry happens where the message lives. There is no cloud copy to outlast it.
Full-text search runs on your phone. The index never leaves it.
Find what you said yesterday or last year. The search stays on the device that knew.
In practice
Amana is the same software in every deployment. What changes is the room around it.
Cabinet briefing, late evening
The Chief of Staff opens Amana, taps a four-person group, and shares tomorrow's draft statement. The timer is set to twenty-four hours. By morning the message has erased itself from every device in the conversation. The server that carried it never read a word.
Joint operation, no signal
A field unit deploys to a network with no internet egress. Amana runs on a single host inside the same LAN. Calls connect peer-to-peer; messages travel through envelopes nobody outside the chat can open. There is no cloud to lose, because there is no cloud.
Quarterly close, blackout window
Three executives coordinate the pre-disclosure sequence. Each conversation is set to auto-delete after the announcement. Legal has the policy on record. The chat does not.
Cryptography
Amana's server is a relay, not a confidant. It moves encrypted envelopes between devices. It cannot decrypt them. Not now, not later, not with a warrant.
relay only
Deployment
The same Amana runs in your data centre, on a closed LAN, or on a single network segment with no internet at all. Decide once how you want to be reached. The product follows.
Public endpoint, TLS from a public authority, optional relay for traversal. Best for distributed offices and inter-agency reach.
No internet. Your own certificate authority. Your own relay. The deployment most ministries and defence customers choose.
A single network segment. Calls connect peer-to-peer. No relay required. For field and forward deployments.
Built for
Cabinet briefings, ministerial coordination, diplomatic channels.
Command channels, joint operations, field communications.
Treasury, dealing-room compliance, executive coordination.
Comparison
A short, honest comparison. Each line is a yes-or-no fact that any security review will check.
| Capability | Amana | WhatsApp Business | Signal | Self-hosted Matrix |
|---|---|---|---|---|
| Server cannot read message text | yes | yes | yes | depends depends |
| Server hosted under your jurisdiction | yes | no | no | yes |
| Runs with no internet egress | yes | no | no | partial partial |
| Group call media stays on your infrastructure | yes | no | no | yes |
| No mandatory account recovery or cloud backup | yes | no | no | yes |
"depends" / "partial" reflect Matrix configurations that vary by deployment. Compared against vendor documentation at the time of writing.
Frequently asked
Hours for an internet-connected install. A day or two for an air-gapped one. We sit alongside your team for the first deployment and hand over a documented runbook so future installs run themselves.
If they have used WhatsApp or Signal, they already know how. The first-launch flow is two screens. The conversation, group, and call surfaces are intentionally familiar.
Annual licence per user, banded by deployment size. No per-message fees. No metered storage. Pricing is quoted per engagement so that ministries, militaries, and banks can be compared on their actual usage shape.
Yes. A scoped 30-day pilot on a deployment we stand up with your team. The pilot environment is yours from day one; you keep it whether or not we go further.
Reproducible builds. Source escrow available for sovereign customers. Your deployment continues operating without us. That is the architecture, not a contingency clause.
WhatsApp is a managed service hosted by Meta in jurisdictions you do not control. Amana is a product you install in a jurisdiction you do. The daily experience for your users is similar. The risk profile is not.
Built to outlive the conversation it carries.
When the discussion ends, the record ends with it. The institution remains.
Talk to us
Not a sales bench. The engineers who wrote the protocol take the meeting, hear the constraint, and tell you honestly whether Amana fits.
contact@amana.app