- SEALENGAGED
- UPLOADS0
- OUTBOUND0 PKT
- TELEMETRYNONE
- KEYS ON SERVER0
- TRACKERS0 · EVER
Sealed.Cold.Yours.
A complete software suite, installed on your machine: documents, spreadsheets, presentations, mail, messaging and a browser. Everything is encrypted on your own disk and nothing is uploaded. We built it so we cannot read your data. Not a promise. The math.
- DraftDocuments
- GridSpreadsheets
- BriefingPresentations
- DispatchMail
- RelayMessenger
- PeriscopeBrowser
There is no cloud to upload to.
A typical office, mail or chat suite is a website wearing an app's clothes: your files go up to their servers the moment you type. ColdBunker is the opposite. The programs are installed on your machine, your files are files on your disk, encrypted, and there is no ColdBunker server waiting for them.
- 0files uploaded
- 0accounts required
- 0cloud copies
- 6apps, all installed locally
Nothing leaves the bunker.
No uploads, no telemetry, no update pings, no crash reports, no analytics, no "anonymous usage statistics". Your files are never sent anywhere to be worked on. The suite opens no connection you did not ask for, and an automated capture test proves it on every build.
$ bunker-capture --all-apps --exercise-every-feature opening Draft, Grid, Briefing, Dispatch, Relay, Periscope … listening on all interfaces for 600 s expected peers: user mail server · user Outpost · pages the user typed unexpected outbound connections ........ 0 telemetry / crash / update beacons ..... 0 third-party hosts contacted ............ 0 RESULT: SEALED (build accepted)
- 0trackers
- 0telemetry pings
- 0bytes of your data sent to us
- 0keys on any server
Pull the cable. Nothing stops.
The suite is offline-first. Flip the switch: the network goes away and all six apps keep running, because none of them needed a server to begin with. Only sending mail, delivering a message or syncing waits for the cable to come back.
- Draftrunning
- Gridrunning
- Briefingrunning
- Dispatchrunning
- Relayrunning
- Periscoperunning
Connected. Mail, messages and sync move when you tell them to. Everything else never touched the network in the first place.
Six lockers. One vault. One install.
The whole suite you would normally rent from a cloud, installed on your own machine as real programs and sharing one encrypted store. Nothing in any of them is uploaded. Open a locker.
Draft
DocumentsThe word processor. Write, format, export DOCX and PDF. All of it in the vault, none of it in a cloud.
Open DraftGrid
SpreadsheetsSheets, formulas, charts. XLSX in and out. Your numbers never touch a server.
Open GridBriefing
PresentationsSlide decks. Build, present, export PPTX and PDF. The whole office trio shares one engine.
Open BriefingDispatch
MailA full IMAP, SMTP and JMAP mail client with a local encrypted store. PGP is automatic between Bunker users and opt-in to outsiders. Reads and composes offline.
Open DispatchRelay
MessengerEncrypted group messaging built on MLS. No phone numbers, no SMS, no address-book upload. Your identity is a key on your device. Ships on Android in v1 too.
Open RelayPeriscope
BrowserA tabbed browser on the platform webview, with no bundled browser engine. DuckDuckGo by default, tracker and ad blocking on, history and bookmarks in the vault. It contacts nothing on its own.
Open PeriscopeKeys stay. Crates travel.
Your devices encrypt before anything moves. What crosses the wire is a sealed crate of ciphertext and the small header a vault needs to sync. The key never crosses the barrier, so an Outpost, ours or yours, holds nothing it could read.
Cold storage
Every byte sits encrypted on your disk: SQLCipher for structured data, an encrypted blob store for everything else. The key is derived from your passphrase with Argon2id and never written down.
Zero outbound
Nothing leaves unless you open it. Every build runs under a network capture and is rejected if a single packet goes anywhere you did not ask for.
Your keys, your machine
Generated on your device, kept on your device. We never have them, so we can never hand them over. That is what "cannot" means on this site.
Hosted or self-hosted. Your call.
Let Net-Com run your Outpost
A subscription. We run the store and relay in our own data centers, you point your devices at it, and sync between your machines and the people you choose just works.
What it holds: encrypted blobs and the vault headers needed to sync them. It never receives a key and holds no readable content.
Run your own
Free. A single binary or a container on any box you control. Same protocol, same guarantees, and the only server in the picture is yours.
Pair your devices with its address and nothing about your vault ever touches Net-Com.
Read this before you trust us.
We will not oversell this. If you use our hosted Outpost, it stores encrypted blobs and the headers needed to sync them: a vault id, a creation time, the Argon2id parameters. Never a key, never readable content. Headers can be used to guess a passphrase offline, so choose a long one; the app insists.
Your browser's cookies and site data live where the operating system keeps them, not in the vault. Periscope's history and bookmarks are protected; its cookies are not.
We tell you exactly what is protected and what is not. That is the whole point.
Not available yet.
ColdBunker is in development. No installers are published. When the suite ships it will arrive here first: a signed Windows installer, a notarized macOS app, a Linux build and Relay for Android, each with its network-capture proof.