A European platform where confidentiality is structural

Organisations that take confidentiality seriously are asked to choose two of three things: a product deep enough to run the working day on, encryption the operator cannot undo, and data that stays in Europe under a European seller. The suites give depth and give up the other two. The encrypted messengers give confidentiality and stop at conversation. Enclessa is the attempt to hold all three at once, and the reason it is a narrow product rather than a broad one is that holding all three is expensive and holding it while also building a document editor is not possible.

• Confidentiality that is a property of the room rather than a policy somebody maintains
• Enough depth to run the work: messaging, calls, boards, time and personnel records
• One European Union hosting region, a German seller, and an export you can take at any time

Quavon UG (haftungsbeschränkt), registered as HRB 35427 at the Amtsgericht Traunstein and seated in Rosenheim. It is both the seller of record and the operator of the service: the people who write the software are the people who run it, and there is no reseller or third-party operator between you and the infrastructure. Enclessa is a commercial product. Its source is not published, it is not distributed to anybody, and there is no licence to install it — every organisation, including an Enterprise one, runs on infrastructure we operate, hosted by netcup GmbH in Karlsruhe, Germany.

• Sold and invoiced from Germany by Quavon UG (haftungsbeschränkt), with EU VAT shown separately on every invoice
• Operated by the same company that develops it
• Commercial and closed-source, on top of a stack that is open source throughout
• Every runtime dependency carries an OSI-approved licence, checked by a gate in continuous integration that fails the build when a dependency relicenses

Three of them are written into the plan the codebase is held to, and each of them shows up in the product rather than staying an engineering preference. The first is as little code as possible, as much as necessary: an abstraction has to have three real callers before it is created, because every line is maintenance and maintenance is what eventually stops a small vendor from patching quickly.

• As little code as possible: fewer moving parts, fewer places for a bug to be, a narrower product on purpose
• Safe default paths: the most convenient way to do something must also be the safe way, so an access check lives in the data layer where it cannot be bypassed by a hand-written query
• Deviations are written down: a decision that changes is amended in the plan and recorded as an architecture decision record, rather than quietly diverging

End-to-end encryption and server-side processing are mutually exclusive, and no product design removes that. A server that cannot read a message cannot search it, cannot apply a retention rule to it, cannot export it for a compliance request and cannot generate a link preview for it. Most products resolve this by using the phrase "end-to-end encrypted" loosely. Enclessa resolves it by making the trade-off a visible feature: a room is either end-to-end encrypted or server-managed, the mode is fixed when the room is created, and the room says which it is.

• Direct messages and group direct messages are end-to-end encrypted and cannot be read by anyone outside them
• Channels are server-managed, which is what makes full-text search, retention and compliance export possible
• A room cannot be switched between the two modes afterwards, because either the old history would be exposed or it would become permanently unreadable
• Search does not disappear in an encrypted room, it moves: the index is built and queried on your own device

Enclessa holds no certification and has had no external audit, so the honest answer is published detail rather than a badge. The confidentiality guarantee rests on an IETF standard and an audited open-source implementation of it, not on a scheme of ours, and the parts a security reviewer needs in order to argue with us are documented.

• MLS as specified in RFC 9420, implemented with OpenMLS and compiled once in Rust for every client
• The architecture, the data model and the OpenAPI surface are published
• Tenant isolation is proven by a probe suite generated from the API document: 286 cross-organisation operations driven, 286 refused, and the build fails if that ever changes
• A full organisation export in open formats, at any time, so leaving is a button rather than a negotiation

The scope is a decision rather than a backlog. Each of these was considered and cut, and cutting them is what makes the rest of the product small enough to reason about.

• Not a document editor: no co-authoring, no wiki, no Office replacement. Files are stored, versioned and displayed, not edited
• Not a project management tool: task boards exist as an optional module, without playbooks, dependencies, automation rules or burndown charts
• Not a phone system: no PSTN calling, no call queues, no auto attendants
• Not an identity provider, and not a marketplace: no third-party code runs inside Enclessa