Secure team chat– encrypted end to end
Your team gets a modern chat. Direct messages and invited rooms are end-to-end encrypted by default. You do not depend on outside cloud services.
Request a demoAt a glance
- End-to-end encryption
- Rooms & threads
- Stand-alone or linked to partners
- Mobile, desktop and web
- Teams bridge in preparation
- Voice and video calls
Features at a glance
Here are the parts of a modern, secure team chat. You run it all yourself, and the chat fits into the rest of the platform.
Your Own Chat Server
Your own server is the core of your chat. If you want, it links to the servers of partners.
Apps for Every Device
Your team chats on the web, on the desktop and on phones with iOS or Android.
End-to-End Encryption
Each message is encrypted end to end. Only the sender and the recipient can read it.
Rooms & Threads
Each topic gets its own room. Threads keep side talks in one place, so nothing gets lost.
Teams Bridge (in Preparation)
A bridge to Microsoft Teams chat is in preparation. It opens only after a data protection review.
Voice and Video Calls
Call single colleagues or whole groups right from the chat. No outside service is needed.
Technology & integration
The chat uses an open protocol that lets servers link up. You can run your server on its own. Or you can link it only with partners you trust. Either way, you keep full control of your data.
- • Your own chat server on an open protocol
- • Apps for web, desktop and mobile
- • Encryption modeled on Signal
- • Central login (single sign-on via OIDC)
- • Proven database in the background
- • Microsoft Teams bridge in preparation
Your benefits
- Your data stays with you, not in outside clouds
- One login for all services (single sign-on)
- Messages stay on your servers
- Open source, with no vendor lock-in
Technical foundation
SecTepe.Comm builds on proven open-source parts here. Chat runs on Matrix with the Synapse server and the Element app. Keycloak, PostgreSQL, Jitsi, LiveKit and mautrix complete the setup.
How team chat works in practice
At the core is your own chat server. It keeps rooms and messages in a database. Uploaded files stay in a media store on the same server. Your team uses the chat app on any device.
How the setup is built
- Users sign in through the central login (single sign-on). The chat server takes the user name, display name and email from there.
- Open sign-up and guest access are off. New accounts come from the central login or from an admin.
- End-to-end encryption is on by default for direct messages and invited rooms.
- Video calls start from a chat room and use the video conferencing service. On a single server, you can also run a second call service. It encrypts media on the device, so the server only forwards encrypted streams.
Links to other servers: off by default, open by choice
The default setup does not talk to other chat servers. Its list of allowed partner servers is empty. Local rooms, encryption and sign-in still work as usual. The public room list is not shared with other servers either.
You can add trusted partner servers to the allow list. Branch sites work this way. Each site runs its own small chat server. It links only with the central server and the partners you list. These links are always encrypted and check certificates.
Operations and data control
- Admins manage users through the admin interface of the chat server. Its web version is only reachable over VPN.
- The chat server does not send usage stats to the open-source project behind it.
- Link previews never fetch addresses from private or internal networks.
- In the dedicated-lite model, each tenant gets its own chat server and database. It is bound to the login area of that tenant.
- An optional security add-on scans chat messages with the same engines as incoming mail. By default it only flags hits. It can also remove them.
Common questions
Can we chat with people on Microsoft Teams? A Teams bridge is in preparation. It covers chat only, not calls. Each user signs in with their own Teams account directly at Microsoft. Their password never touches our systems. The bridge stays closed until a check against data leaks (DLP review) approves it.
What if someone loses all their devices? The chat app offers a key backup. The user saves a security phrase once. With it, they can restore their message keys on a new device.
Can anyone create an account? No. Open registration is off. People join through your central login, or an admin creates the account.
Ready for secure messaging?
We plan and roll out your team chat together with you. We start with a pilot and go all the way to federated use.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.