End-to-end encrypted communities with real money tools - and a public discovery layer that's fully moderated. Two surfaces. No blur. We can't read your private messages; we don't take your audience; we barely take a cut.
Every private channel, call, and DM is sealed on your device before it touches our servers. Not premium. Not a mode you enable. The default.
Everything Enclave does lives on exactly one side of this line. It's how we can be truly encrypted and genuinely safe.
Servers, DMs, working groups, org workspaces. End-to-end encrypted with MLS. Keys live only on members' devices. We relay ciphertext.
Discovery feed, Flares, shop listings, public server pages. Public by intent - so not encrypted, and fully moderated before anything goes live.
Content only crosses from private to public through one deliberate act: an authorized member publishes it. At that moment it leaves encryption, enters the moderation pipeline, and goes live only after it passes. Nothing crosses the other way. Nothing crosses automatically. The private side is never scanned; the public side is never unscanned.
Structure, live rooms, moderation, money - built on rails that can't betray you.
Channels, threads, DMs. Sealed end-to-end with MLS group encryption before they leave your device.
Live rooms and stages, encrypted frame-by-frame with SFrame. Media servers route packets they can't decode.
Granular roles, permissions, private channels, invite controls. Serious structure for serious communities.
Recurring paid tiers that gate channels and perks. Subscribing is cryptographic admission, not a database flag.
One-tap tips anywhere; limited merch and digital-goods releases. 95% to the creator, paid out fast.
Sell entry to live encrypted AMAs, premieres, and workshops. Entitlements, not screenshots of QR codes.
Same encrypted core. A different toolkit on top - pick your mode.
Design membership tiers; gate channels, roles, and events; price in 135+ currencies with annual & founding options.
CreatorReal-time earnings across subs, tips, tickets, and Drops; payout schedule; one-click tax exports. 5% + processing. No other fees.
CreatorAnalytics that respect encryption: growth, retention, tier conversion - computed from aggregates, never message content.
CreatorMember CRM: tier history, join source, churn-risk flags, private notes. Your audience relationship, exportable and yours.
CreatorWelcome flows: rules acceptance, role pickers, tier upsell prompts, scheduled drip intros that turn a join into a regular.
CreatorClient-facing encrypted rooms with scoped guest access, expiring invites, and watermarked preview mode.
Arts & ProsEncrypted version history on every file: uploads versioned automatically, change notes, one-click restore.
Arts & ProsReview & approval on artboards, frames, and PDFs: annotations, approval states, and a sign-off trail.
Arts & ProsShared encrypted workspace storage with role-scoped folders - living inside the room's key hierarchy.
Arts & ProsFinal-delivery packaging: bundle deliverables with license terms and get a cryptographic delivery receipt.
Arts & ProsA one-way encrypted submission inbox: sources submit without an account, metadata minimized end to end.
PrivacyPer-server pseudonyms with no cross-server identity linkage; member lists hidden from non-admins by default.
PrivacyPer-channel message expiry, one hour to ninety days, plus device-level panic wipe.
PrivacyOne tap freezes invites, hides channels, and forces re-verification when a community is under threat.
PrivacyRaid & infiltration alarms from metadata alone: mass-join spikes, scraping patterns, invite tripwires.
PrivacySSO (SAML/OIDC) and SCIM provisioning: onboard and offboard from your identity provider.
BusinessAdmin console: audit trail of admin & membership events, device management, role templates. Metadata only - content stays encrypted.
BusinessRetention & compliance exports under org-held escrow keys: your compliance team can decrypt; Enclave never can.
BusinessSelf-hosted or region-pinned deployment. Your keys, your metal, your data residency.
BusinessExternal-partner rooms with scoped access, expiry dates, and guest-tier permissions.
BusinessTiers, payouts, CRM, scheduling, drops - plus Livery custom branding - and analytics that work without reading a single message.
Design and price membership tiers.
Earnings, payouts, tax exports. 5% flat.
5% + processing. no other fees.Encryption-safe analytics.
Member CRM you own & export.
Welcome & onboarding flows.
Event scheduling, RSVPs, reminders.
Merch & digital releases, mirror to Shop.
Full custom branding & join URL.
Tiers, tips, and ticketed events are native - and 95% of every payment is yours.
On Discord you monetize through workarounds and hand over 10%. On YouTube it's 30%. On Twitch, up to half. Enclave takes 5% - and the fee is the whole relationship. We don't also own your discoverability, your member list, or your right to leave.
Enclave Pro, $8/month. Bigger uploads, more storage, larger rooms, HD video - and every file end-to-end encrypted.
| Limit | Enclave Free | Enclave Pro · $8/mo | Discord / Nitro | Slack / Pro |
|---|---|---|---|---|
| Max file upload | 100 MB | 5 GB | 10 MB / 500 MB | 1 GB |
| Encrypted storage | 5 GB | 250 GB | - | 5-10 GB |
| Voice room size | 100 | 500 | 99 | 2 / 50 |
| Stream quality | 1080p30 | 1080p60 + 4K | 720p / 4K60 | ~720p |
| Community size | 10,000 | 100,000 | 500,000+ | Unlimited* |
| End-to-end encryption | Always (MLS) | Always (MLS) | Voice only | None |
| Take-rate on your income | 5% | 5% | 10% subs | n/a |
*Competitor limits as publicly documented; re-verify before relying on them.
Client-held keys. Zero knowledge. Every file chunked and sealed with AES-256-GCM under your room's key. Subpoenas get ciphertext.
Encrypted storage in every plan.
For heavy media libraries.
Archive everything, encrypted.
Pooled, shareable to org rooms, 5 admin seats.
An open standard for group keys, a media router that can't hear, and a payment rail that can't read.
Your device generates its own cryptographic identity. Private keys never leave it. We never see them.
MLS (RFC 9420) - members form a key tree that re-keys a ten-thousand-person server in milliseconds when anyone joins or leaves. Newcomers can't unlock the past; compromised devices are locked out at the next rotation.
What crosses the wire - and what we store - is ciphertext plus minimal routing data. That's everything we could ever be forced to hand over.
Rooms run over a media router using SFrame (RFC 9605), keyed by your group's MLS secrets. Every frame is encrypted on-device; the router forwards what it cannot decode.
Subscriptions, tips, and tickets run through a Stripe-powered payments layer that knows who paid for what and nothing about what anyone said.
Our managed cloud - infrastructure we run but can't read - or self-host for full metadata sovereignty. Same protocol either way.
The honest version of "how do you allow encryption and still stop CSAM": you split the platform in two, and you never lie about which half you're standing in.
What we can't do - and why we say so. Content on the private surface is end-to-end encrypted. We hold no keys. We cannot scan your messages, files, or calls for anything - not ads, not "safety," not law enforcement. Any platform that claims to scan end-to-end encrypted content is describing a backdoor, and a backdoor built for one purpose is available for every purpose, to everyone who ever controls the scanner. We won't build it.
Safety by tools, not surveillance: cryptographically-verifiable reports (message franking), behavioral & metadata detection (raids, grooming patterns), hard account-level bans, minors private by default, and consent-based automod bots the room chooses.
Perceptual-hash matching (PhotoDNA-class for images, CSAI-Match-class for video) against NCMEC & IWF known-CSAM databases, ML classifiers for unknown material, human review, and seller KYC. Confirmed CSAM is reported to NCMEC/IWF as law requires.
A reported message carries cryptographic proof it's authentic and unaltered. Our team acts because the recipient chose to reveal it - consent, not surveillance. False reports can't forge evidence.
Raids, spam bursts, invite-farm networks, ban evasion, and grooming-pattern signals (adults mass-contacting minors) are all visible in metadata - no content required.
Under-18 accounts are private, closed to stranger DMs, invisible in discovery, and cannot publish to the public surface. Adult servers sit behind age gates.
Nothing appears in the Commons unscanned. Hash-matching + classifiers + human review run before anything goes live in the public feed, Flares, or shop.
Shop sellers pass payment-grade identity verification - removing the anonymity abusers depend on. Appeals exist and are handled by humans.
Confirmed CSAM on public surfaces is reported to NCMEC's CyberTipline and IWF where applicable. We publish a transparency report.
| Surface | E2E encrypted? | Content-scanned? | Protected by |
|---|---|---|---|
| DMs | Yes | No | Franked reporting, metadata, blocks |
| Private servers & groups | Yes | No | Mod tools, opt-in automod, Sentinel |
| Org workspaces | Yes | No | Org-held keys, Helm audit (metadata) |
| Self-hosted servers | Yes | No | Your infrastructure, same protections |
| Commons feed & Flares | No - public | Yes, before publish | Hash-matching, classifiers, humans, NCMEC/IWF |
| Shop listings | No - public | Yes, before publish | Same + seller KYC |
| Guildhall profiles & briefs | No - public | Yes, before publish | Same + Hallmark KYC |
| Commission workrooms | Yes | No | Deal file on payment rail; franked evidence by consent |
Flares - short, public videos with comments and reactions - plus shop listings and server promotion. TikTok-Shop energy, pointed at communities instead of an algorithm's guess about you. Creators publish Flares and premieres, attach product cards from Drops, and pin a join card for their server.
Browsing is public; joining takes you through the door into an encrypted space the feed can never see back into. A server's public presence is a separate object, populated only by what admins deliberately push through the Airlock. Checkout happens in-feed on Enclave rails (5%).
Yes - there are ads here, and only here. Companies and creators pay to promote Flares and products on the public square: first-party, clearly labeled, and contextual to what you're browsing - never built from anything behind the walls, never a third-party tracker. Your private servers and DMs stay ad-free and untracked, forever.
And because the Commons is public, every card - ads included - already passed the Airlock: hash-matching, classifiers, human review, seller KYC, no minor publishing.
A talent directory, commissions with real payment protection, and disputes settled by humans - on the public square, at half the going rate.
The Commons is where communities get discovered. The Guildhall is where they get hired. Every listing is Hallmark-verified, every review comes from someone who actually paid through protected payments, and commissions run the way they should: structured brief, money held in payment protection before work starts, milestones released as you approve, delivery with a cryptographic receipt. If a deal goes sideways, a human arbitrates from the deal file - we judge the contract, not your conversation.
Payment-grade KYC plus human portfolio review. The badge means the work is theirs and the payout can find them.
Brief → payment protection → milestones → Handoff delivery with a cryptographic receipt. Funds move only when you approve - or a referee decides.
Only counterparties of completed, payment-protected jobs can rate. No drive-bys, no farming, no pay-to-delete.
Flat-price, clearly-labeled placement. Contextual only, capped at 1-in-12, and organic reach is never throttled to sell it back.
first-party · no trackersBrands buy the creator's audience relationship. They never buy the audience's data - because we don't have it to sell.
£2,400 budget · music-production communities · EN · EU · one sponsored premiere + pinned card.
5k-10k members · top-quartile weekly-active · UK/EU · English. Consented aggregate bands only, k ≥ 200.
Brands post briefs with real budgets. Creators publish a sponsor card built from the same encryption-safe metadata that powers Pulse - every field an explicit toggle. Here is the line, in writing: no member lists, no messages, no per-member data, no pixels, no retargeting, no lookalikes - not negotiable, and mostly not possible. A brand can sponsor your community for years and never learn a single member's name. The Desk adds 10% on the brand's side, so you keep 100% of your quoted rate. Agencies take 15-30% out of yours.
And if a deal includes a shout-out inside your encrypted server, we'll paper it - but we can't see in there to measure it, and we won't pretend otherwise. Verified deliverables live on the public surface.
The Guildhall can put your work in the window. It can't see into the workshop.
An open platform - with the encryption honesty baked into the developer model, not hidden from it.
A bot is a cryptographic member with its own keys - so it can read only the channels it's added to. We put that on the label: adding a bot is an explicit admin action, every channel shows its keyed members, and a system notice posts when one joins. Plugins are client-side and never hold room keys.
Embedded multiplayer games and activities inside voice rooms - watch parties, whiteboards, tournaments - on a TypeScript SDK with CRDT room-state sync and in-activity purchases. An activity sees who's playing, never your messages or call audio.
One storefront for bots, plugins, and activities. Verified developers, signed builds, permission manifests shown before install, listings moderated like all public content. Devs keep 90% - the lowest cut of any major app marketplace.
Own the room, the list, the archive - and the exit.
When we're asked for data we don't have, the answer writes itself.
Enclave ships first-party apps (desktop + mobile, open-source clients). Its sibling Kage is the end-to-end messenger for 1:1 and small groups. Two apps, one promise, same cryptography (MLS).
Found your enclave in early access - free while we build, 5% forever when you earn.