Trust, Verified

Infrastructure You Can Verify Swiss-rooted. Globally distributed.

Arpokrat is legally domiciled in Switzerland and runs its relay network across independent jurisdictions, on hardware built to resist physical compromise — not just remote attack. This page shows how it is built, so you do not have to take our word for it.

View Warrant Canary Inside the hardware

Our servers are dumb by design. They never learn who's talking to whom — and forget the rest.

  • NotAmazon Web Services
  • NotGoogle Cloud
  • NotMicrosoft Azure
  • NotCloudflare
  • NotOther US-Based Providers
Independence by design

Independent of the US hyperscalers

Arpokrat’s infrastructure runs on none of the major US cloud platforms — not Amazon Web Services, Google Cloud, Microsoft Azure, or Cloudflare — and others. That is a deliberate architectural choice with a concrete legal consequence: a US CLOUD Act order works by compelling a US-based provider to hand over data it controls, and Arpokrat operates no infrastructure on those providers for such an order to reach. These four are simply the best-known examples — the same reasoning rules out any provider under US jurisdiction.

New to the CLOUD Act?

The Swiss Core

Domiciled and hosted in Switzerland

Where a company is based decides which governments can compel it. We chose Switzerland deliberately.

Our legal entity is established in Zug, under the same Crypto Valley framework that made the canton a home for cryptographic and decentralized projects. Our public web servers run in Geneva, in Tier III+, ISO-certified data centers, and fall under the strict Swiss Federal Act on Data Protection (FADP).

Coat of arms of Switzerland
Hardware & Operations

Hardened for physical access

Encryption protects data in transit. But a relay is a physical machine in a rack — so we also design for the day someone gains physical access to it.

RAM only, no swap

Messages awaiting delivery live only in volatile RAM, never on disk. Swap is disabled, so the system can’t page that memory out to storage — which is what makes RAM-only actually hold.

Power-off wipe

Because pending data lives only in RAM, cutting power clears it instantly. A relay examined after shutdown holds no message content on disk.

Minimal access

Administrative access is limited to two people — redundancy if one is unavailable, without widening the attack surface.

Signed offline, air-gapped

Release manifests for ArpokratOS, the Messenger, and the web installer are signed on a dedicated, air-gapped Qubes OS machine that has never touched the internet — and never will. The signing keys never reach a networked device.

Relay Network

Five jurisdictions, chosen for their law

Relays in privacy-law countries, independent of major surveillance alliances — no single jurisdiction controls the network.

This is the deeper reference behind what the Messenger page summarizes.

Flag of Switzerland Switzerland
  • Protection: strict FADP data-protection law; outside the EU and EEA, so it sets its own rules.
  • Log retention: no blanket data-retention mandate for mere-conduit (relay) services.
  • Network: the country hosts CERN’s internet exchange (CIXP) and dense European peering — high-capacity, low-latency routes.
  • Reach: a low-latency hub for Central and Western Europe.
Flag of Iceland Iceland
  • Protection: home of the IMMI initiative, a body of law designed to protect sources and free expression.
  • Log retention: no mandatory blanket retention imposed on transit providers.
  • Network: a renewable-powered fiber grid with substantial international throughput.
  • Reach: a mid-Atlantic bridge between Europe and North America.
Flag of Panama Panama
  • Protection: Law 81 on personal-data protection; a jurisdiction legally independent of the US and EU frameworks.
  • Log retention: no general obligation to record traffic logs or user IPs for transit services.
  • Network: the country is a landing point for numerous submarine cables as a hub of the Americas.
  • Reach: a gateway between North, Central, and South America.
Flag of Malaysia Malaysia
  • Protection: governed by the PDPA 2010, under a legal system outside the ‘14 Eyes’ intelligence alliances.
  • Log retention: no retention requirement imposed on transit or over-the-top services.
  • Network: served by the Cyberjaya technology hub and modern, ISO 27001-aligned data centers.
  • Reach: a high-capacity access point for the Asia-Pacific region.
Flag of Mauritius Mauritius
  • Protection: the Data Protection Act 2017 is aligned with the EU GDPR; an independent jurisdiction outside the ‘14 Eyes’ alliances.
  • Log retention: no mandatory data-retention obligation for transit or relay traffic.
  • Network: the island is a landing point for the SAFE and LION submarine-cable systems.
  • Reach: an Indian Ocean hub linking Africa, the Middle East, and Asia.

Verify it yourself

Our warrant canary is updated and PGP-signed on a regular schedule. As long as it keeps appearing, we have received no secret order we could not tell you about.

View Warrant Canary Read the Code

Every canary entry is PGP-signed — you can verify the signature yourself.

See what this means for your messages on the Messenger page
Running communications for an organization? Explore Enterprise