Morse Mesh
// chat, voice & video on MatrixSovereign secure communications on Matrix: a Rust homeserver and a branded web client, end-to-end encrypted, with federation closed by default. Chat, voice and video in one stack, deployable per tenant on your own infrastructure and air-gap capable. Real-time video and telephony ride the same sovereign posture, not a third-party cloud.
Chat that reaches your partners without reaching a vendor's cloud: encrypted end to end, federated only where you allow it, and running entirely on infrastructure you control.
Built in the United Kingdom on Matrix, an open protocol with an independent specification. No proprietary wire format and no vendor to be locked into.
Every tenant gets its own homeserver and its own database. No telemetry, sovereign by design, deployable on-premises, in your cloud, or fully air-gapped.
Team chat your people will actually use
Rooms, spaces, direct messages and calls in one client, with the encryption running quietly underneath.
Rooms, spaces & DMs
- Familiar rooms and spaces to organise teams, projects and topics
- Direct messages and group chats, encrypted end to end without a setup step
- Threads, replies, reactions, mentions and read receipts
- A browser client with nothing to install; runs on your own origin
Voice & video, in the room
- Start a call from any room: voice and video without leaving chat
- Media rides a self-hosted SFU on your infrastructure
- Calls work with federation closed; nothing phones home to a vendor cloud
- Screen sharing and multi-party rooms as standard
Sign in the way you already do
- OIDC / SSO sign-in, with the provider a per-deployment choice
- Provider-agnostic by design: Keycloak, Entra, Ory Hydra or your own
- Straight to your identity provider, with no intermediate click
- The homeserver picker and self-service can be locked off per tenant
Bots & notifications
- Incoming webhooks from any system that speaks HTTP: CI, monitoring, alerting
- A bot framework for in-room commands, scheduled jobs and reminders
- Bots run inside your deployment, not as a third-party SaaS connector
- Build your own, or run one of the many community plugins
A live picture, brought into the room
A call in Morse Mesh is not just faces on a grid. Pull in camera feeds and bridge in people on the phone, so the room becomes the place a situation is worked rather than only discussed.
Feeds alongside faces
- Pull a camera, stream or video source into a live call as its own tile
- Sources arrive by URL pull (HTTP, HLS, RTSP) or by push (WHIP / RTMP)
- Run several feeds at once, added and dropped while the call continues
- Adding a new source is a configuration change, not a redeployment
Bridge in a phone lineSIP
- Dial out to any phone number and drop that person into the encrypted room's call
- Reach the people who aren't on the platform: field staff, duty officers, third parties
- Runs over your own SIP trunk, with TLS and media encryption available
- Outbound by design: no inbound listener, so there is no number to attack
Driven from the chat
- Calls and feeds are controlled by commands in the room, from any client
- The room's history is the log: who pulled which feed, who dialled whom, when
- Feeds and call legs are torn down automatically when the call ends
- A full operator console is next: video wall, per-feed selection and layouts
Sovereign, not just self-hostedThe difference
- The media server is yours, per tenant, on your infrastructure
- Video and telephony keep working with federation closed to the outside world
- No third-party SFU, no vendor cloud in the media path, no telemetry
- The same posture as the chat: if it only works via someone else's cloud, it isn't a Morse Mesh feature
Yours, down to the posture
Ship the client under your own brand, and set the rules your users operate under rather than inheriting a vendor's defaults.
Your brand, not oursWhitelabel
- Branded login screen, client, welcome and about pages
- Per-organisation clients, each pointed at its own homeserver
- Nothing in the interface tells your users whose software this is
- Deployed on your domain, on your own single HTTPS origin
Decide who talks to whomFederation
- Federation is closed by default and opened only where you choose
- Allow-list the specific partner organisations you intend to reach
- Cross-organisation rooms that stay encrypted end to end throughout
- Working with partners needs no third party in the middle: the protocol does it, not a proprietary bolt-on
- Or run entirely islanded: no federation, no internet, air-gapped
Set the rules centrally
- Force encryption on and federation off at room creation, by policy
- Turn off room discovery, developer tools and account self-service per tenant
- File-sharing controls in flight: block sharing, or allow and deny by file type
- Users get a client shaped to your policy, not a settings page to undo it
Run it where you like
- Container images for the whole stack, deployed with Docker or Kubernetes
- Per-tenant isolation: each tenant its own homeserver and its own database
- On-premises, in your cloud, or fully managed by us: your call
- Open standards throughout, so migrating away stays possible
Encryption built in, not bolted on
The engineering underneath: an open protocol, a Rust homeserver, and cryptography we did not invent ourselves.
CryptographyCore strength
- Matrix end-to-end encryption, specified in the open and independently reviewed
- Message keys are held on your users' devices, never on the server
- Encrypted by default in direct messages, and enforceable by policy everywhere else
- Device verification and cross-signing, so users can confirm who they're talking to
- The server stores ciphertext it cannot read: hosting Mesh does not mean reading Mesh
- We track MLS as the next-generation protocol without betting the product on it yet
Architecture & platform
- Rust homeserver on PostgreSQL: one process per tenant, a small operational footprint
- Built on an open protocol and foundations we control, not a black box we resell
- The whole tenant behind a single HTTPS origin; everything else stays on a private network
- Container images from our own CI, with tested, pinned component pairings per release
- Open protocols cross domains: a security gateway can only pass what it can inspect, so an open protocol can traverse one where a proprietary format never will. We test for it
What runs in your tenant
The whole stack, on your infrastructure, behind one HTTPS origin. Nothing in this list is a service we operate on your behalf unless you ask us to.
Deployable on-premises, in your cloud, or entirely air-gapped. Each tenant is isolated: separate homeserver, separate database, no shared state.
Where it's going
A clear trajectory from sovereign team chat toward a real-time operations platform. What's shipped is on the left; we mark the rest as intent, not inventory.
Now
- Encrypted chat on a Rust homeserver, per-tenant, with federation closed by default
- Allow-listed federation between organisations, demonstrated across three homeservers
- SSO / OIDC sign-in, provider-agnostic per deployment
- Admin console: users, rooms, media, federation and roles
- Voice and video on a self-hosted SFU, working with federation closed
- SIP bridging: dial a phone number into an encrypted room's call
- Video injection: pull camera and stream sources in as live tiles
- Webhooks and bots running inside the tenant
In progress
- Audit logging and retention policy: the compliance gate for regulated buyers
- File-sharing controls: block sharing outright, or allow and deny by file type, globally and per room
- Alerting & email notifications across ops, security and user flows
- Streamlined SSO redirect straight to your identity provider
Secure, private, and integrated. All three.
air-gapped, or fully managed.
Not even we can read your messages.