Skip to content
Enclessa
Get started

e2eeOpen beta · hosted in the EU

Encrypted teamwork,hosted in Europe.

Enclessa is a hosted workspace, in open beta, for organisations that need confidentiality, functional depth and European data protection at the same time: encrypted messaging, video calls, task boards, time tracking and personnel records on one permission model. You create a workspace; we run the infrastructure.

Create your workspaceSee what is included

Open beta, open to anybody. Free plan, no payment card. Paid plans start at €6 per member.

The platform is being built in the open, so parts of it are not there yet, behaviour changes between releases, and no availability figure is committed while it is in beta.

Release stage
Open beta, open to anybody
Delivery
Hosted service at your-team.enclessa.app
Hosting region
European Union, one region
Encryption
MLS per RFC 9420 for direct messages
Free plan
Yes, permanent, no payment card
Data export
Full organisation export on request
Seller
A German company, EU VAT applies

Enclessa runs on an entirely open-source stack

  • PostgreSQLPostgreSQL
  • NATS.ioNATS.io
  • LiveKitLiveKit
  • DockerDocker
  • KubernetesKubernetes
  • PrometheusPrometheus
  • GrafanaGrafana
  • Traefik ProxyTraefik Proxy

What is Enclessa?

Enclessa is a European collaboration platform in open beta, delivered as a hosted service at your-team.enclessa.app. It combines team messaging with channels and threads, end-to-end encrypted direct messages using MLS per RFC 9420, video calls with screen sharing, and twelve optional modules — task boards, GitHub sync, projects, customers, contracts, bookings, employee cards, mail, time tracking, personnel records, a Lexware Office ledger connector and an assistant — all on one permission model. There is a free plan, the infrastructure is run for you in the European Union, and every organisation can export everything it holds at any time. The open beta is open to anybody: no invitation, no waiting list, and no availability figure committed while it lasts.

Confidentiality that is structural

Direct messages are end-to-end encrypted with MLS per RFC 9420, one key per device. The server runs delivery and holds no key, so there is no administrator override to trust and no escrow to discover later.

How the encryption works

Depth, not a chat box

Threads, search, files, calls, boards, GitHub, time tracking and personnel records — the work and the conversation about it in one place, sharing one permission model instead of four invitation lists.

Everything included

Sovereignty you can verify

Hosted in the European Union by a German seller, with a published data model, an OpenAPI surface and a full organisation export. Leaving is an operation, not a negotiation.

Security and data protection
Features

Why organisations with something to protect choose Enclessa

Confidentiality, functional depth and control of where the data sits are usually on offer two at a time. This is what it takes to have all three without running the servers yourself.

e2ee · what the server stores

8f2a c471 9b03 ee5d 1a77 3c90 b6f2 40ad 77c1 e0b9 5d34 aa18 92ef 0c6b

epoch 41 · leaf 3 of 7

managed · what the server stores

“Ward round moved to 14:00 — the export for the review is already covered.”

indexed · retention 5 y

Two room modes, and no pretending

End-to-end encryption and server-side search are physically mutually exclusive, so Enclessa makes the trade-off a visible product decision rather than a footnote. Direct messages are always encrypted; channels are managed, so they can be searched, retained and exported. The room says which it is.

Direct messages are e2ee. No administrator override.

group epoch 41

Laptop

leaf

Phone

leaf

Desktop

leaf

MLS, not a protocol we invented

One MLS group per conversation, one leaf per device, through OpenMLS — the audited implementation, compiled once in Rust and shipped to every client. We run the delivery service and hold no keys.

RFC 9420 · forward secrecy · post-compromise security

IK
TR
ML
AB
screen shareframe-encrypted

Calls that start where the conversation is

One-to-one and group calls on LiveKit with screen sharing, a lobby, host controls and in-call chat, started from the room you are already in. In encrypted rooms the media is encrypted end to end too, which is why recording is not offered there.

Designed for 50 participants per media node

Triage

Rate-limit the invite endpoint

GitHubissue

Retention job overruns

GitHubissue

In review

Gateway 3 — socket drop

GitHubissue

Board → GitHub push order

GitHubissue

Done

Encrypted attachment chunking

GitHubissue

Boards where the decision was made

A task board that inherits the team it belongs to and links back to the conversation the work came from. Point one at GitHub and issues become cards, pull requests attach to the card they close, and check results arrive without opening a tab.

A module. Off until you switch it on.

redeploy windowserver

#incident-2026-08 · 09:41

#release-train · Tue

#general · 12 Jul

redeploy windowon device

Direct · Ines Kern

Direct · Tobias Ruf

FTS5 index, encrypted at rest

Search, retention, export, audit

In managed channels the server can read, so it does the work: full-text search over messages and file contents, retention rules, compliance export and an audit log. In encrypted rooms the same search runs on your own device against a local encrypted index.

The capability moves. It does not disappear.

Modules

Twelve things you can switch on, and nothing you did not ask for

Every one of these is a module of the same platform, sharing its permission model, and several of them need nothing but the platform itself. Leave one off and it is not merely hidden — its routes do not answer at all.

BoardsKanban boards owned by a team, using that team’s roles, with cards that link back to the conversation the work came from.How it works
GitHubTwo-way issue and pull-request sync onto those boards, with check results on the card and write-back that is opt-in.How it works
TimeAttendance and project time recorded separately, timesheets submitted and approved, absence against an entitlement ledger.How it works
PeopleEmployee records, a vacancy-aware org chart, effective-dated history, governed documents and onboarding that provisions.How it works
ProjectsWhat the organisation is working on: an owner, dates, a budget, milestones, and the risks and decisions taken along the way.How it works
CustomersThe companies you work with, their contacts and the projects, hours and appointments that point back at them.How it works
ContractsThe agreement built from the customer record, over a clause library, issued as a signed and frozen PDF.How it works
BookingsSomebody outside asks for a time and somebody inside answers — through your own site or a link we serve.How it works
CardsAn employee card derived from the employment in force, with a verification page a stranger can read.How it works
MailYour own mailboxes read and answered inside the product, granted per mailbox, with threads attachable to a customer.How it works
FinanzenBooked hours proposed as invoice drafts in your own Lexware Office ledger, and every voucher mirrored back.How it works
CompanionAsk in your own words. It finds what you may already see, proposes the change, and you decide.How it works
How it works

From an email address to a room you can trust

Four steps, and only the first one is ours to do for you. There is no server to provision, no certificate to renew and nothing to install.

Step 1

Create the workspace

Sign up with an email address and a password. The account, the organisation and your membership are created together, and you land in a room already signed in — there is nothing to install and no server to provision.

  • Your organisation gets its own address at your-team.enclessa.app
  • One account can hold memberships in several organisations and switch between them
  • Rename the organisation whenever you like; the address follows
Create your workspace

Your workspace

nordwind.enclessa.app
Account
anna@nordwind.de
Organisation
Nordwind
Your role
Owner

Created in one transaction. Nothing to install.

Solutions

Where the line between readable and unreadable falls

Every sector draws that line in a different place, and Enclessa does not pick for you — it makes the line visible, per room. Each page below names the constraints that sector actually has.

  • Public sector

    Data that stays in the EU, an auditable record of who did what, and an exit that is an export rather than a negotiation.

    Read the public sector case

  • Healthcare

    Clinical discussion in rooms the server cannot read, with operational channels that stay searchable and exportable.

    Read the healthcare case

  • Engineering teams

    Channels wired to the boards and repositories the work happens in, without shipping the backlog to a third party.

    Read the engineering teams case
Security

Claims you can check

There are no customers to quote here yet, so this band quotes the architecture instead. Every line below is traceable to a numbered section of the document the build is held to — and the security page lists what Enclessa does not have as plainly as what it does.

Real end-to-end encryption, or none of the word

MLS per RFC 9420 through OpenMLS, one key per device, safety numbers for verification. Compliance in an encrypted room is only ever a recipient key visible to everybody in it — never a copy taken quietly on the server.

Architecture §3, §10

One organisation cannot reach another

Isolation is asserted at a single choke point and proven by a generated probe suite that drives every operation the API offers as one organisation against another’s identifiers. All 286 are refused, and the suite fails the build if that ever stops being true.

Architecture §7.4

Safety number

482139027561048339270751482360194855470226139708514309698274
  • Device Amatches
  • Device Bmatches

Two devices, two humans, one number — that is what verified means here.

Every runtime dependency is open source

Not an aspiration but a licence gate in continuous integration that fails the build when a dependency changes its licence. It is why several otherwise obvious components are not in the stack, and why there is no proprietary black box between your data and the disk.

Architecture §4.3, §20

No lock-in to walk back out of

PostgreSQL, NATS and LiveKit underneath, a published data model, an OpenAPI surface and a full organisation export in open formats. The exit is a button, not a support ticket and not a negotiation.

Architecture §7, §8

Security, encryption and what we do not have
Pricing

One price per person, and the modules decide the tier

A seat is an active member of your organisation. Bot accounts, guests and deactivated people are not counted, so an integration never appears on the invoice.

Billing period

Free

For a small team that wants the conversation encrypted without a purchase decision first.

€0

up to 10 members

Permanent, not a trial

Create a workspace
  • Teams, channels, threads and direct messages
  • End-to-end encrypted direct messages
  • Video calls with screen sharing
  • Search across the last 90 days
  • Web and macOS clients
  • No payment card, and no expiry

Starter

For a team past ten people that wants the conversation encrypted and nothing else switched on.

€6

per member / month

Billed monthly or yearly

Start free trial
  • Everything in Free, without the member limit
  • Full-text search across the whole history
  • File upload with malware scanning
  • Custom branding, sign-in message and invitation policy
  • Email support

Team

For organisations running the work itself in Enclessa, not only the talking.

€11

per member / month

Billed monthly or yearly

Start free trial
  • Everything in Starter
  • Task boards that inherit team roles
  • GitHub two-way issue and pull-request sync
  • Projects: owners, milestones, risks and decisions
  • Bookings: appointments asked for from outside
  • Incoming webhooks and custom slash commands
  • Bot accounts and scoped API tokens
  • Audit log and data export

Business

For organisations that also run time, absence and personnel records here.

€17

per member / month

Billed monthly or yearly

Start free trial
  • Everything in Team
  • Time tracking, timesheets and approvals
  • Absence with an entitlement ledger
  • People: records, org chart and documents
  • Cards: a verifiable employee card, derived from the employment
  • Customers, Contracts and Mail
  • Finanzen: invoice drafts in your own Lexware Office ledger
  • The Companion, proposing changes you approve
  • Onboarding and offboarding workflows
  • Retention rules and legal holds

Enterprise

For organisations that need the platform on infrastructure of their own — dedicated, in a region they name, still operated by us.

Custom

Annual agreement

Talk to us
  • Everything in Business
  • A dedicated deployment, run by us, in a region you name
  • Your own database, storage and media nodes — no shared tenancy
  • Named contact and an escalation path with agreed response times
  • Security advisories ahead of public disclosure
  • Procurement, compliance and architecture documentation
  • Deployment review and recovery drills

Prices are net of VAT. The seller is established in Germany, so German VAT is added where it applies and the reverse charge is used for valid EU VAT numbers outside Germany.

Questions

The questions that actually get asked

Is Enclessa in beta?

Enclessa is in open beta: anybody can create a workspace today, without an invitation and without a waiting list. The platform is being built in the open, so parts of it are not there yet, behaviour changes between releases, and no availability figure is committed while it is in beta. What is on this site is what is built: the messaging, encryption, calls and modules described here work today, the limits are stated on the page that claims the capability, and the roadmap says what is still missing. Beta does not mean the free plan expires or that data is treated as disposable — a full organisation export is available throughout.

What is Enclessa?

Enclessa is a hosted collaboration platform for organisations, currently in open beta, combining team messaging with channels and threads, end-to-end encrypted direct messages, video calls with screen sharing, and twelve optional modules covering boards, GitHub, projects, customers, contracts, bookings, employee cards, mail, time tracking, personnel records, a ledger connector and an assistant. It is a commercial software-as-a-service product, run in the European Union by a German company, with a free plan and paid plans priced per member.

Do I need to install or host anything to use Enclessa?

No, and there is no version of Enclessa you can install. It is a hosted service: you create a workspace, it is reachable at your-team.enclessa.app, and we operate the infrastructure. Organisations that need a deployment of their own buy it on the Enterprise plan, where we run dedicated infrastructure for them rather than handing over software to run.

Where is Enclessa hosted and who is the seller?

Enclessa is hosted in a single European Union region and sold by a company established in Germany, so EU VAT applies and is shown separately on every invoice.

Is Enclessa open source?

No. Enclessa is a commercial software-as-a-service product and the source is not published. What is published is the part a buyer actually has to check: the architecture, the data model, the OpenAPI surface, the subprocessor list and the encryption design. The encryption itself is MLS per RFC 9420 through OpenMLS, an open standard and an audited open-source implementation, so the guarantee does not rest on anything of ours being trusted.

Is there a free plan?

Yes. The Free plan is permanent rather than a trial: a small team gets channels, threads, end-to-end encrypted direct messages and video calls without a payment card. Paid plans add the optional modules, longer retention and higher limits.

Which parts of Enclessa are end-to-end encrypted?

Direct messages and group direct messages are always end-to-end encrypted using MLS per RFC 9420. Channels are managed, meaning the server can read them, which is what makes full-text search, retention policies and compliance export possible.

Can several organisations share one account?

Yes. One account can hold a membership in several organisations and switch between them from the sidebar without signing in again, seeing in each exactly what that membership allows and nothing of the others.

Which clients does Enclessa have?

The web application is available today and a macOS desktop application is in development. Mobile applications for iOS and Android are planned and not yet available.

How much does Enclessa cost?

Enclessa has a free plan and three paid plans priced per active member per month, differing by which modules are included. Bots, guests and deactivated accounts are not counted as seats. Enterprise is quoted rather than listed, because it includes a dedicated deployment run for the organisation. See the pricing page for the current tiers.

Encrypted collaboration, hosted in Europe.

Create a workspace in a couple of minutes. It is yours at your-team.enclessa.app, hosted in the European Union, with encrypted direct messages from the first one you send.

Create your workspaceSee pricing

Open beta. Free plan, no payment card to start.