What "secure communication" means here
No system is unbreakable. What does exist is communication the vendor cannot read, that authorities can only obtain by law, and that is useless to a thief who takes your phone. We get there with three things: handsets without Google or Apple services, chat that is end-to-end encrypted on a server you own in the Netherlands, and e-mail on your own domain that we operate. What it is not: a guarantee that nothing ever fails. Whoever promises that is selling a feeling.
The risk is not hypothetical
In February 2026 the details of 6.2 million people leaked via Odido and Ben, obtained through phishing and social engineering rather than a dramatic break-in. If you do not control the SIM cards your staff uses, you can lose numbers and with them access to accounts. On top of that, Dutch numbers are registered to a person and that data is reported periodically to the CIOT. For a lawyer with a source, an accountant with a file, or a board mid-negotiation, that is the exposure, not the theory of cryptography.
At the same time, most "secure chat" products Dutch companies actually use are American, free, and paid for in metadata. You pay for the leak, not the vendor.
What we deliver
- A ready privacy phone — a Pixel with GrapheneOS, installed by us, your own app list tested before delivery, signed in to your mail and calendar. Nothing for you to flash.
- Managed Matrix and Element chat — workplace messaging with end-to-end encryption on your own Dutch server, desktop, web and mobile, plus SimpleX for anyone who wants no server at all.
- Recovery codes and two-factor, in order — the most common failure is not an attack but an employee who loses their recovery codes and therefore the account.
- Managed e-mail on your own domain — EU server, SPF/DKIM/DMARC configured correctly, backups with an annual restore attempt. Ask us; we will not publish a price until one is settled.
Difference from an app subscription
| WhatsApp, Teams, Signal | Managed by GSAP | |
|---|---|---|
| Reports and metadata | Visible to Meta and Microsoft; limited for Signal, but not zero | Yours, on your server |
| Where the data sits | The vendor's data centres, mostly in the US | A Dutch server you own, operated by us |
| Leaving | You stop, your history stays with the vendor | You take the server and the archive with you |
| Retention duty | Conditional, behind expensive add-ons | Configurable per room, keys preserved |
| Outage or incident | A status page and a form | One contact with an agreed scope |
| Backups | Unknown, often absent for chat | Tested: we attempt a real restore each year |
How we work
- Conversation. What must be protected: the content, the identity of the speakers, the archive, or the fact that you are speaking at all? That question decides the design.
- App and risk check. We walk your application list and test what each app demands of an uncertified device. Dutch banks and DigiD generally work through sandboxed Google Play; some apps refuse. We do this before delivery, not after the first complaint.
- Delivery with explanation. Devices arrive configured, with your mail and profile in place. Your team gets a short walkthrough and a one-page summary, not a forty-page manual.
- Operation. Updates, checks, backups and incidents are ours. What we do not do is written into the agreement, precisely because we operate it and want the scope to stay honest.
Who this is for
Lawyers, accountants and tax advisers, notaries, healthcare and welfare, HR advisers, municipal teams, and any company where one conversation can change the outcome of a deal. Being small is not a problem; so are we. We work in Amsterdam, The Hague and Rotterdam and deliver across the Netherlands.
Questions we hear often
Is this not suspicious or illegal?
No. Encryption is legal and in several sectors expected. The difference lies in what you do with it, not in which protocol you choose.
Do I have to understand all of it?
No. That is the product: we advise, configure and operate; you use it.
Will my bank still work tomorrow?
App support changes with updates, for every vendor. So we test your own list and re-test after major updates, instead of publishing a claim nobody maintains.
What if we want to leave in five years?
Matrix is an open standard with export. You take your messages and files with you. That is the main difference from a SaaS subscription.
Can we start small?
Yes. One phone and one room is a start. Expansion follows.