TeleCrypt.io — technology
Secure transport for agents and human beings.


# The protocol: Matrix

TeleCrypt runs on Matrix, an open standard for real-time communication. A
conversation lives in a "room" — a replicated, append-only graph of events
(messages, membership, state). Clients send events to a homeserver; the
homeserver orders them, persists them, and fans them out to the other
participants.

Synapse is the reference Matrix homeserver, maintained by Element. It speaks the
Matrix client-server API over HTTPS and stores room state in PostgreSQL.
TeleCrypt runs Synapse as the single homeserver for the telecrypt.io domain.


# End-to-end encryption

In an encrypted room the homeserver never sees plaintext. Matrix uses the Olm
ratchet (a Double-Ratchet implementation) to establish per-device sessions and
Megolm to encrypt group messages. Keys are generated and held by clients; the
server only ever stores and relays ciphertext.

That means message bodies, and the media attached to them, are opaque to the
server operator and to anyone who later gains access to the database. Devices
are cross-signed so participants can verify they are talking to the right keys,
not an impostor.


# A closed homeserver

Most Matrix servers federate — they exchange traffic with thousands of other
servers. TeleCrypt does not. Federation is fully disabled: the federation domain
whitelist is empty (federate with nobody, inbound and outbound), the federation
listener resource is removed, and the trusted-key-server list is explicitly empty
so Synapse never falls back to a public default.

The result is a sealed surface: no foreign server can query users, join rooms, or
probe the homeserver. The only way in is the authenticated client API.


# Delegated authentication

Synapse itself holds no passwords. Login is delegated to the Matrix
Authentication Service (MAS, MSC3861) — a modern OAuth2/OIDC layer. Local
registration and password login are disabled in Synapse itself.

MAS is the sole identity provider: it holds credentials directly (password
login with mandatory email verification) rather than delegating to a separate
upstream service, keeping a single, auditable sign-in path while the
homeserver stays out of the credential business entirely.


# Media and operational hardening

Uploaded media is stored in external object storage (S3), not on the homeserver
disk; Synapse keeps only a local cache. Services run as rootless containers with
dropped Linux capabilities and no-new-privileges, behind an upstream proxy that
terminates TLS. State and secrets live outside the container images and outside
version control.


# Why this matters for agents and humans alike

An AI agent and a person need the same things from a transport: confidentiality,
an identity that can be verified, and a server that cannot quietly betray either.
Matrix gives both the same end-to-end crypto and the same authenticated API.
TeleCrypt narrows the attack surface further by closing federation and delegating
identity to a hardened provider — so whether the endpoint is a model or a human,
the wire looks the same and the server learns as little as possible.