X-39 Comunicaciones
Encrypted calls, video calls and messages between two phones. A separate app from X-39 Evidencia, by the same project.
How it works
The key for each call is agreed between the two phones with ML-KEM-1024 (FIPS 203) and signed with ML-DSA-87 (FIPS 204). Audio and video are end-to-end encrypted with that key, which the server does not have. This has not yet been audited by a third party.
Traffic can go through an optional WireGuard tunnel to a server of ours. No e-mail account and no phone number: your identity is a key created on the phone that never leaves it. Each contact shows the fingerprint of their key, to be compared in person or over the phone.
Status: closed beta, by invitation
The code and the public download arrive in November 2026, together with the threat model, the deployment guide and the privacy page. Until then the app is handed out by hand to those who ask for it and test it with us.
To request access: security@x39matrix.org
When it is published
This page will carry the APK, its SHA-256, the signing-certificate fingerprint and the commands to check them, as on the Evidencia page.
Why two apps
When sealing or anchoring from Evidencia, only a 32-byte commitment derived from the fingerprint is sent to the calendars. If you choose to send a capsule to a paired phone, the original travels end-to-end encrypted. Comunicaciones needs the microphone, camera and an open connection while you talk. From Evidencia, a button opens Comunicaciones if installed, or brings you to this page.
What it is not
With the tunnel on, whoever watches your network does not see who you talk to or what you say: they see encrypted traffic to our server. But they do see that you use X-39, they can infer from the traffic pattern that a call is going on, and they can block the tunnel, as several countries already do with WireGuard. The server does not know the content, but it does know that two keys talked, when and for how long. If your phone is compromised, none of this protects you. It is not anonymous. It is a beta with no external audit yet: it can fail.