Talk to Aella
Add her to a DM or an existing group. She answers as Aella. Stella is the office desktop; Skjal is the phone.
Mobile · E2E · talk to Aella
Skjal
Skjal is the mobile chat for the site. When Aella is installed, everyone can message her directly — the same as any other person in the room. Humans keep talking to humans.
Self-hosted end-to-end chat. Logout purge. Aella as a peer when she is installed. You operate the relay.
How people use it
Talk to people
1:1 and groups stay human-to-human. Keys live on the device. The relay never sees readable chat.
Leave nothing behind
Logout purges local conversation. Leave a room and your messages become placeholders. The owner can delete the room.
What is actually protected
Skjal is built as a self-hosted E2E messenger. We describe what ships — not a certification we do not hold.
- End-to-end between people — 1:1 Double Ratchet and group sender keys in the browser. Ciphertext on the relay, plaintext only on the device.
- Logout purge — Closing the session wipes local history. That is the product default, not an optional tidy-up.
- You operate the relay — No vendor multi-tenant chat cloud. Placement, backups, and access policy stay inside your perimeter.
- Aella is disclosed — When she is in a room the client decrypts and the gate forwards plaintext to her. Human rooms stay E2E. That path is not a secret.
Independent crypto audit has not yet been performed. Treat Skjal as a serious self-hosted messenger, not as a certified national system.
Against the usual chats
Slack and Teams keep readable history for the tenant admin. Signal and WhatsApp are excellent E2E apps you do not operate. Skjal is the site-owned middle.
Not a SaaS inbox
No hosted workspace mining your rooms. The ciphertext lives on a relay you can turn off.
Not only a consumer app
Callsign login, group rooms, Aella as a member, and a military profile when the unit needs it.
Not a classified guarantee
We do not sell Common Criteria or NATO accreditation. High-assurance sites still do their own evaluation.
Military profile
Civilian is the default. A military deployment mode exists for units that need a tighter appliance.
- Unit binding — A unit fingerprint can be shown so operators know they are on the intended appliance.
- Ephemeral accounts and TTL — Military mode can require shorter-lived callsigns and message lifetime. Sealed sender (hide sender from the relay) is on the v1.1 path.
- Mandatory wipe — Military policy can force wipe-on-logout instead of leaving it as a civilian convenience.
This is a product profile, not a government certification. Say so in tenders.
Phone first. Your relay.
Install it with Aella and Stella. Open the app when the site is ready.