The Postern Store — presented honestly
Every entry below carries an honest status badge. Built means the Rust core compiles and its tests pass. Reference prototype means a working front-end that demonstrates the design. Design / spec means a documented plan, not running software. And everything — no exceptions — is unaudited.
The cores
The verified Rust foundations (crates/postern-*). All of them seal with one canonical primitive set: an XChaCha20-Poly1305 AEAD seal and an Argon2id KDF, so one core to audit protects everything.
Post-quantum hybrid wallet (Falcon‖ML-DSA), diversified addresses, on-device key vault. Talks to the ownerless protocol via public RPC — now the unaudited mainnet beta (nascent, 51%-attackable), so the coins it holds carry no value claim and are not for investment.
A secrets / password vault, sealed at rest. Reuses the wallet's key-wrapping design (StrongBox / Secure Enclave class) — highest infrastructure reuse in the portfolio.
Serverless person-to-person file drop: the payload is sealed with ML-KEM-1024 (FIPS-203) and delivered over an ephemeral Tor onion service. No server ever holds your file.
The end-to-end-encryption core: Megolm group encryption via vodozemac (the Matrix project's Rust Olm/Megolm, Apache-2.0, audited by Least Authority in 2022 — that audit covers vodozemac, not this product).
The user-facing attestation verifier: self-audit and peer-verify. Turns the Seal from invisible infrastructure into something you can see and use — verify Postern's claims instead of trusting them.
A panic button that instantly re-locks: one call seals the vault. It destroys nothing — an ethics decision, not a limitation.
A passkey / FIDO2 credential core. Identity is the biggest unfilled gap in the permissive-license daily-driver — this is the Apache-side answer.
Document metadata scrubbing for OOXML, ODF, and JPEG — the author fields, revision trails, and EXIF that leak when nothing else does.
Shared plumbing you don't install separately: Postern Core (the one canonical seal), Postern Quarantine (inbound-document safety — the mirror of Hygiene), Postern Tor (in-process Tor via Arti), Postern Telephony (carrier SMS/calls surface for Postern OS Mobile), and the Postern SDK (one UniFFI surface over the whole suite for Android / iOS / desktop). All built and test-verified; all unaudited.
The apps
Each app is a single self-contained HTML file. Where an AI concierge is offered, you bring your own Claude key — nothing is proxied through us. Every app carries an honest privacy panel, and none of them claims “100% private”.
A quiet, privacy-first voice assistant.
A quiet lookout on the markets — voice-driven; your holdings never leave the device.
A private interpreter and meeting-minutes taker.
Say what you need; it parameterizes the search across the catalog.
Sign in with your wallet — no email, no account.
The onboarding configurator — set up your Postern, including transparent (never covert) parental and corporate controls.
The enterprise admin console: Chinese-Wall separation, dual-control escrow, LGPD/GDPR/CCPA-enabling controls.
See them in action
Each clip is the actual app running, narrated and subtitled. All are pre-release beta and unaudited. Where an app offers an AI concierge, you bring your own Claude key and that cloud path is honestly the less-private one — nothing is proxied through us (except the clearly-labelled Tolmach subscription tier). Nothing shown is a security claim.
OS & platform
| Surface | What it is | Honest status |
|---|---|---|
| Postern OS (node appliance) | A reproducible NixOS image that boots straight into a running node — same inputs, same image. Nix profiles in os/. | profiles: built image: build from source unaudited |
| Postern OS — Desktop & Mobile | The daily-driver privacy OS: reproducible, hardened, attestable. Foundations exist as NixOS / Mobile-NixOS profiles; the full daily-driver is to build. | design / spec unaudited |
| Postern Desktop | A Tauri desktop app for your existing OS: node companion, wallet, miner view, live logs. | backend: built build from source unaudited |
| Postern Container (Android) | A hardened, attestable privacy workspace on the phone you already own — the planned entry product. | design / spec |
| Cloud edition | Confidential-VM deployment (SEV-SNP / TDX) — spec in docs/specs/. | design / spec |
| Enterprise edition | Identity & governance model (wallet-as-login, org controls); Consiglio is its console prototype. | design / spec reference prototype |
Licensing, suite-wide: MIT / Apache-2.0 per crate, no GPL/AGPL embedded anywhere in the products. Ready to try something? Head to downloads — and read the disclaimer first.