Incident response
Coordinate responders and external specialists without mixing the event into personal messaging accounts.
Operational communications / Android
Private coordination for critical work.
M2 gives incident teams, field operators, and sensitive advisory groups a compartmented place to coordinate—without phone numbers, email addresses, or a global user account.
Download for Android
v0.6.3+2040 · Approx. 46 MB
Signed arm64 APK · Android 13+
Signed arm64 APK · Android 13+
Installable on Android 13 and later.
Incident response
Red teams
Sensitive advisory
Field operations
View system architecture ↘
System postureAccountless. Compartmented. Onion-routed.
IdentityScoped to each Channel
TransportTor fails closed
RelayCiphertext only
ReleaseSigned APK + checksums
Designed around the operation
Start with the mission. End with the Channel.
M2 is designed for defined work with a clear boundary—not for building a permanent social graph. A Host creates a time-bounded Channel with a one-time M2 Code, and up to 12 people including the Host join by capability.
Red-team operations
Keep project identity, encrypted files, and communications separated from everyday accounts and contacts.
Sensitive advisory
Control membership and protected-file release for legal, investigative, and transaction work.
Field coordination
Create a time-bounded communications space for inspections, deployments, and crisis teams.
Transport architecture
Dark-web transport technology, applied as infrastructure.
Users do not browse the dark web. The Android app uses embedded Tor to reach a persistent v3 Onion Service. If the Onion route is unavailable, production does not quietly fall back to a public gateway.
01Encrypt on the endpointSignal state + attachment AEAD
02Route through embedded TorNo local DNS resolution
03Relay encrypted payloadsOpaque routing identifiers
04Verify receipt, then deleteSigned ACK + retention workers
Operational controls
Control the endpoint, the file, and the lifecycle.
Security is expressed through specific control points. Each one has a defined boundary and documented limitations.
Single Passcode
One ordinary Passcode gates encrypted local state. A locked vault never background-decrypts or moves Signal private material outside that boundary.
Commit before notification
A constant-only data wake starts one coalesced Tor synchronization. M2 posts the final message notification only after the message is durably available locally.
Screen capture available
Normal Android screenshots and screen recording are enabled in this pre-launch release. Protected files still hide export actions; endpoint access and external capture remain outside the cryptographic boundary.
Protected files
A receiver requests approval from the original sender before a protected file can be viewed inside M2. Download and sharing remain blocked after approval.
One-time M2 Code
A Code creates a Channel, adds time, or reactivates an expired Channel. Customized Codes remain operator-issued. The active in-app PayPal catalog is USD 9.90 per selected member, from 2 to 12 members including the Host, for one calendar month; M2 always shows server-authoritative terms before checkout.
Active, expired, deleted
Expired Channels are read-only. Existing local messages and files remain viewable while reactivation is available; permanent expiry removes server and local Channel data.
Evidence and limits
Verification is reported by scope.
The signed v0.6.1 release repairs Android's protected PayPal handoff so checkout can create an order and open the PayPal approval page. It retains server-priced capacity from 2 to 12 members at USD 9.90 per member for one calendar month. Create uses the capacity selected in the app, while Reactivate uses the Channel's existing capacity.
Review security evidenceSigned arm64, universal APK, and AABPASS
Staging message, attachment, voice memo, FCM/Doze, ACK and accelerated-TTL E2EPASS
Ten-wake one-worker/one-Tor coalescing and commit-before-notification assertionPASS
Retention fault injection, exact tester purge, and initial empty statePASS
B-v1 APP/DB, encrypted backup/restore, retention and production smokePASS
v0.6.1 exact-signed Android payment preparation and Live approval-page readinessPASS
PayPal Sandbox Create and Reactivate approval URLsPASS
PayPal Sandbox payer approval and captureNOT RUN
Tor fail-closed, replay, forged ACK, and quota pathsPASS
Affected-device and second-device physical regressionNOT RUN
Independent third-party security auditPENDING
Signed Android release
Deploy a private Channel.
Download the owner-authorized signed v0.6.1 release for current Android devices. Universal and arm64 APKs, the AAB, reviewed source, mapping, symbols and verification files are available from the immutable public release prefix.