Hush
BetaSecure communications
Pseudonymous, end-to-end-encrypted team communications.
An internal communications hub where employees talk under aliases in real-time forums and exchange end-to-end-encrypted direct messages. Real identities live in a database schema the application cannot reach, so a compromised or SQL-injected backend still cannot read who is who. Unmasking an alias is possible, but only through a separate endpoint that writes to an audit log.
At a glance
- Best for
- Organizations that need safe internal speak-up channels
- Sector
- Security & infrastructure
- Built with
- TypeScriptFastifyNext.jsPostgreSQLRedis
Highlights
Real identities isolated in a private schema only a superadmin database role can read
End-to-end-encrypted direct messages — the server stores and relays ciphertext and public key bundles only
Safety numbers let two people confirm they hold each other's real keys
De-anonymization runs through a separate endpoint and is written to an audit log
What Hush does
Identity siloing by design
Personal data lives in a private.identities table reachable only by a superadmin database role. The app connects as a least-privilege role with no access to that schema, and automated tests assert the permission denial holds.
E2EE direct messages
DMs are encrypted in the browser with the Web Crypto API — ECDH key agreement, HKDF, AES-GCM — and the server never holds a key it can decrypt with. An opt-in passphrase-encrypted key backup, opaque to the server, lets you recover on a new device.
Real-time forums
Alias-based forums for candid discussion, delivered over WebSockets with Redis pub/sub so messages reach clients across backend replicas. Forum posts are multi-reader and deliberately not end-to-end encrypted.
Audited admin access
A super admin can map an alias back to a real identity, and can read forum posts and message metadata — but never DM content. Every de-anonymizing read is logged, giving accountability without everyday exposure.
Have something to build, or run?
Whether you need a product shipped, a system kept healthy, or a hand with a hard integration — let's talk.