Cryptographic Tenant Isolation
Encrypted Workspaces, Not Chat Rooms
Tenant-scoped, purpose-built workspaces that bring together people, AI agents, workflows, and custom message types — all inside a single Hybrid MLS encrypted boundary. Isolated by cryptography, not policy.
One Identity, Many Contexts
Per-Space cryptographic isolation
Every Space generates a unique cryptographic keypair — Ed25519 for authentication and Kyber for post-quantum key exchange. Your identity, keys, and data in one Space cannot bleed into another. Isolation is enforced by mathematics, not access control lists.
Zero Data Bleed
Contacts, messages, and files are strictly siloed. A compromise or policy change in one Space has zero impact on any other.
Distinct Cryptographic Identities
Unique keypair per Space means you are a completely different entity to the server in each context.
Enterprise Control Without Overreach
Organisations enforce policies, retention, and access within their Space — without touching your Personal Space.
Alice's InTouch Account
Single account — three isolated Spaces
Personal
Alice
Keypair
0x4A…9F
Isolated
Acme Corp
Alice Chen (Engineering)
Keypair
0x7B…2C
Isolated
Board of Directors
A. Chen
Keypair
0x1D…8E
Isolated
Structured & Typed
The Space data model
Every Space is a rich object — not a flat list of participants. Type, tenant, membership, workflows, and MLS state are all first-class attributes, stored as encrypted metadata the server cannot interpret.
{
}
Purpose-Built
A Space for every workflow
Eight built-in Space types — each pre-configured with industry participants, AI agent roles, and custom message schemas. Or build your own.
Deal Room
Buyer, Seller, Broker, Solicitor
Care Team
GP, Specialist, Pharmacist, Nurse
Matter Space
Solicitors, Barristers, Paralegals
Mission Space
Operatives, Commanders, Intelligence Analysts
Claims Space
Policyholder, Claims Handler, Assessor
Transaction Space
Buyer, Seller, Estate Agent, Solicitor
Incident Response
SOC Analysts, Incident Commander, Forensics
Project Space
Team Members, Project Manager, Stakeholders
Enforced by Encryption
Three-layer tenant isolation
Tenant isolation in InTouch is enforced at three independent layers. Even with full server compromise, tenant boundaries hold — because they're enforced by cryptography, not access control policies.
Layer 1
Cryptographic
Independent MLS group state per Space. Each Space has its own Hybrid MLS tree — even with full server access, cross-Space decryption is mathematically impossible.
Ed25519 + Kyber keypairs per Space
Layer 2
Authorisation
SpiceDB relationship model enforces that Spaces belong to tenants, and members belong to Spaces. Authorisation is additive — no ambient access.
SpiceDB relationship graph
Layer 3
Protocol
MLS membership changes are cryptographically committed. The server cannot silently add or remove members — every change is verifiable by all participants.
Committed membership changes
Isolation by design, not configuration
Intelligent Automation
Workflows & AI agents, inside the boundary
Every workflow runs within the E2EE boundary of its Space. AI agents are first-class MLS participants — not server-side bots — with their own cryptographic identity and Space-scoped access.
Event-driven triggers
Workflow examples
Trigger
New message with document attachment
Action
Compliance Agent runs KYC checks, validates against requirements
Output
Approval card sent to broker with status update
AI Agent capabilities
Full MLS participant — holds own leaf node with cryptographic identity
Space-scoped access — agents only operate in Spaces they are explicitly added to
MCP tool access — create_space, add_member, register_workflow, trigger_workflow
Verified Agent Identity — Ed25519 + Dilithium keypair, Key Transparency registered
Get started
Your workspace. Your boundary.
Create your first encrypted Space — bring together your team, your AI agents, and your workflows inside a single cryptographic boundary.