Run your own Outpost.
The optional store and relay server, as a single binary or a container, on any box you control. Free. The only server in the picture is yours.
What an Outpost does
Devices encrypt before they send. The Outpost accepts those blobs and the small header each vault needs to sync, holds them until the other device asks, and relays Relay messages addressed to a vault id. It is a post office that only ever handles sealed envelopes and never gets a letter opener.
Run it
Download the Outpost binary for Linux, Windows or macOS, or pull the container image. One process, one data directory, no database server to manage.
Open one port
Expose it over HTTPS behind the reverse proxy you already run, or let it terminate TLS itself. There is nothing else to open.
Pair your devices
Give each device the Outpost address. Pairing is done device to device with a short code; the Outpost never sees a key during pairing or after.
What it holds, exactly
- Holds
- Encrypted blobs; vault headers (vault id, creation time, Argon2id parameters); queued encrypted messages.
- Never holds
- Keys, passphrases, readable content.
- Can see
- Which vault ids moved how many bytes, and when.
- Retention
- Blobs stay until every paired device has fetched them, then are deleted. You set the maximum age.
A vault header is enough to try passphrases against offline. Whoever runs an Outpost, including you, should treat its data directory as sensitive, and every user should use a long passphrase. The apps enforce a minimum.
Hosted instead?
If you would rather not run a server, Net-Com operates Outposts in its own data centers in Pensacola, Florida, monitored around the clock by its network operations center. Same binary, same guarantees. See pricing.