P2P first. Relay when needed.
Voice traffic takes the shortest path the network allows. When NAT or firewall policy blocks direct connections, a passive relay forwards ciphertext between endpoints — never holding keys, never inspecting payload.
Network Architecture
P2P direct or server relay. Either way, the server is blind.
Mode A
P2P Direct
Caller
Peer
When NAT allows it. Lowest latency, lowest cost.
Mode B
Relay Mode
Caller
Peer
When networks block P2P. Relay forwards ciphertext only.
Server never holds keys
Endpoints derive the session secret
ML-KEM-1024 + AES-GCM
Same crypto in both modes
Auto-select
Tries P2P first, falls back gracefully
The relay is a passive packet forwarder. It cannot read, modify, or replay the ciphertext stream — even under coercion.
NAT traversal mechanics
Most home and enterprise networks sit behind NAT or strict firewalls that block inbound UDP. Our client probes peer reachability with ICE-style candidate gathering, then opens a direct path when both endpoints can be reached.
- Candidate gathering on host, server-reflexive and relayed transports
- Symmetric NAT detection falls back to relay automatically
- No external STUN dependency on operator-controlled deployments
Fallback logic
The session always negotiates the same post-quantum key. Network mode is chosen by reachability, not by trust: if P2P fails, the relay takes over within the same RTT budget. The cryptographic envelope does not change.
- P2P attempt window: ≤ 800 ms before relay is engaged
- Mid-call switch supported when network conditions change
- Same ML-KEM-1024 session secret in both modes
No metadata retention
The relay forwards packets and discards them. No call detail records, no call duration logs, no participant graphs. The only state retained is short-lived NAT mapping required to route the next packet.
- No CDRs, no per-call billing logs, no participant graph stored
- Packet metadata kept only for the lifetime of the NAT mapping
- Operator-deployable: relay can run inside your own datacenter
Need a private relay deployment?
Air-gapped, sovereign, on-premise — your operators, your network, your control plane.
Request architecture brief