The same open-source core, deployed differently: your organization self-hosts a closed relay that admits only its members, keeping data entirely on your own infrastructure. The relay only ever sees ciphertext and member public keys — no plaintext, no central conversation store to subpoena, and no third-party SaaS vendor sitting between you and your employees.
Stand up a closed relay whose allowlist admits only organization members; non-roster keys can't connect. Run it on Cloudflare Workers, Docker, or your own hardware — data and metadata stay inside your boundary.
Admins maintain a signed member roster; new hires join with a one-time invite code and automatically receive a work identity plus default contacts/groups. Onboarding needs no phone number or email.
Defaults to work-identity rotation rather than key escrow — the company holds no decryption backdoor. When a member leaves or switches devices, an admin revokes the old and issues a new identity via the roster, and the member's client picks up seamlessly; register two devices to retain history (ADR-0052). Optionally, with the member's explicit consent at onboarding, the work-identity key can be escrowed to allow reviewing that work account after offboarding.
Set offline-message retention days, an allowed event-kind list, and force calls to relay-only (TURN) to meet network or audit policy. Policies are enforced by your self-hosted relay and never leave it.
Plaintext and private keys live only on member devices; the relay forwards ciphertext only. The entire messaging plane runs on your own infrastructure, depending on no official or third-party service — cut off the internet and internal messaging still works.
AGPL-3.0 licensed — both server and client code are auditable; built on the open Nostr protocol, so any compatible relay interoperates. No proprietary formats, no vendor lock-in — you can migrate out anytime.
Enterprise messaging options fall into three groups: cloud suites, self-hosted open source, and E2E self-hosted. This table compares privacy and data sovereignty only — on feature breadth (integrations, search, SSO) they are more mature, that isn't our home turf and we won't pretend otherwise.
| Dimension | Cinderous | Cloud suites (Slack / Teams / LINE WORKS) | Self-hosted open source (Mattermost, etc.) | E2E self-hosted (Element / Matrix) |
|---|---|---|---|---|
| End-to-end encryption by default | ✓ All messages — relays see only ciphertext | ✗ Servers can read content | Not by default; optional in some | ✓ |
| Can admins / operators read members' messages | No — zero-knowledge; even the org owner sees only ciphertext | Yes | Yes (server-side plaintext) | No (room content encrypted) |
| Who-talks-to-whom inside the org (metadata) | Largely hidden (Gift Wrap one-time senders) | Fully visible to the vendor | Fully visible on your server | Homeserver sees rooms & membership |
| Where data lives | Your infrastructure (self-hosted closed relay) | Vendor cloud | Your infrastructure | Your infrastructure |
| Key escrow needed for offboarding | No — takeover via identity rotation; key escrow is optional (member's explicit consent at onboarding) | N/A (not E2E) | N/A (not E2E by default) | Deployment-dependent (server-side key backup is common) |
An honest limitation: with zero-knowledge design, no one — including the org owner and us — can export members' messages in plaintext. Regulated industries that require full message archiving may find Cinderous unsuitable. SSO / SCIM are not yet available.
See the full personal-messaging comparison →
Deploy the relay/ Worker to Cloudflare (wrangler deploy), or self-host node-relay as a container on a VPS / in your data center; configure the allowlist and policies, then members join with an invite code. See the self-hosting docs.
Enterprise mode reuses the exact same encryption core as the regular app — the only difference is who operates the relay and who it admits. There is no separate closed-source enterprise build, and no crypto weakened for features.