Post-quantum encryption · live now

Your team's
private workspace

Channels, threads and search — end-to-end encrypted with post-quantum keys. The structure your work needs, on a server that cannot read a word of it.

Download free Why it's different

No account · No phone number · No analytics

Veil
N
nadia
connected
Channels
#design-review
#engineering3
#incidents
#legal
#hiring1
#design-review
N
nadia9:41
pushed the new sidebar — take a look when you get a sec
the unread badges needed more contrast
T
theo9:44
nadia the unread badges needed more contrast
much better — the grouping makes it actually readable
P
priya9:52
ship it 🚀
Message #design-review
Verified · 1 auditor agrees
#incidents
P
priya2:14
db failover finished, we're green
M
marc2:15
confirmed on my side too
Message→

The gap

You've been choosing
between two halves.

Slack organised your work and read every message. Signal protected your messages and gave you no way to organise them. Veil is the first one that is both.

Slack
Signal
Veil
Channels, threads, search
Yes
No
Yes
Server can read your messages
Yes
No
No
Post-quantum group encryption
No
Pairwise only
Groups too
Metadata protection
None
Partial
Padded & decorrelated
Verify who you're talking to
Trust the vendor
Safety numbers
Audited key log

What you get

A real workspace.
With nothing leaking out of it.

Everything below runs on your device. The relay stores ciphertext it has no way to open — and that isn't a policy, it's a build gate that fails if the server ever links the code that could.

Quantum-resistant today

X25519 + ML-KEM-768 on every group. Traffic captured now stays unreadable to a quantum computer built later — the only time this can be done is before it matters.

Channels and threads

Replies stay attached to what they answer. Unread counts that clear when you actually read. The shape of a workspace, not an endless scroll of DMs.

Search that stays home

Full-text search over an encrypted database on your own machine. Instant, offline, and no query ever leaves the device.

Even the metadata

Message sizes are padded to buckets and delivery is decoupled from fetching, so the pattern of who-received-what can't map out who's in a channel.

Know who you're talking to

A transparency log with append-only proofs, an independent auditor, and clients that compare what each was shown. Substituting a key becomes visible.

Write without signal

Compose on a plane. Messages queue and go out in order, exactly once, sealed at the moment they're actually sent — not before.

Download

Three apps. One core.

The Android app is the same code as desktop, compiled for ARM — so the parts most worth getting right can't drift between platforms.

Android
arm64 · 18 MB
Download APK
Windows
x86-64 · signed · 23 MB
Download
Linux
x86-64 · 19 MB
Download 
# Windows and Linux: unzip and run the app. Nothing to configure.
# It opens its own window, generates your keys on first run, and
# asks for a name. There is no account and no phone number.

# A command-line tool ships alongside it for scripting:
keystone-msg channels
keystone-msg send <channel> <text>
Chrome will call the Windows download suspicious. Here is exactly why.

Chrome opens the archive, finds a program signed by a certificate that does not chain to a commercial authority, and sees a domain it has never handed out a download from. Neither is a finding about the file — it is the absence of a paid reputation. A brand-new publisher looks identical to a bad one until it buys its way out.

Rather than ask you to click through a security warning — a habit worth keeping — install it from PowerShell. This verifies the SHA-256 before anything is unpacked, which is a stronger check than the warning you would have been clicking past.

# Windows — paste into PowerShell
$u = 'https://veil.keystonetech.io/download/keystone-windows.zip'
$h = 'loading…'
$z = "$env:TEMP\keystone.zip"
Invoke-WebRequest $u -OutFile $z
if ((Get-FileHash $z -Algorithm SHA256).Hash -ne $h) { throw 'checksum mismatch' }
Expand-Archive $z -DestinationPath "$env:LOCALAPPDATA\Keystone" -Force

The hash above is read from SHA256SUMS when this page loads, so it always matches the build being served. The direct .zip is still there if you would rather take the warning.

The honest fix is an OV or EV code-signing certificate — EV clears SmartScreen immediately, OV earns it over a few weeks. That is a purchase, not a build change, so the warning stands until someone buys one. The Android APK is debug-signed and will warn on install for the same class of reason.

No web app

Because we'd be handing ourselves your keys

A messenger in your browser is code we serve you every time you open it — and we could serve one person something different. Every proof and audit here assumes your client is honest.

So it runs on your machine, from a binary you chose. Signal has no web client for exactly this reason. It's a refusal, not a gap.

What it doesn't do

Said plainly, because you'd find out anyway

  • No history from before you join. New members see what happens next. Changing that safely needs a key design that outlives the protocol's own — written, and waiting on outside cryptographic review.
  • One device per identity. Your phone and laptop are separate identities today.
  • No push notifications. The app receives while open — background delivery means routing through a third party that learns when your device has traffic.
  • The auditor runs beside the directory it audits. Its whole value is independence, so it doesn't yet mean what it should.

Live

Service status

Delivery servicechecking…
Key directorychecking…
Auditorchecking…