What VENTEX is – and what it is not.
The boundaries that are otherwise spread across many pages, in one place. Every statement links to the page where it is set out in full.
As of 23 September 2026What VENTEX is
A founder-led security project by Ramon Emanuel Galiano. The workstreams describe areas of responsibility, not departments or headcount. Organisation
VENTEX Connect: a communication platform for operational teams, available as a controlled production release. Core communication, device, cryptographic and operational workflows are production-deployed. Product security
Since 6 September 2026, capable devices use hybrid PQXDH session establishment with X25519 and ML-KEM-1024, followed by Double Ratchet. Evidence Center
Internally verified: the state of 9 September 2026 maps 308 requirements to documented counter-tests, plus 19 real-browser runs with 189 checks. Evidence Center
A protocol inspired by the Signal ecosystem but independently implemented. Security model
What VENTEX is not
Not independently audited or certified, and not approved for classified information. The figures above are internal checks, not an external audit. Product security
Not Signal-compatible and not equivalent to libsignal. Security model
Not a continuously post-quantum ratchet: the post-quantum component covers new session establishment. Evidence Center
Not metadata-free: metadata is minimised, but the service still needs routing, membership and timing data. Evidence Center
No customer outcomes yet: the pilots are running, but no results have been published. Pilot Network
No third-party endorsement: Mission Supporters and personal contacts support the mission; they do not review or recommend products. Mission Supporters
Not an incorporated company: VENTEX is currently a project and brand, legally operated by Ramon Emanuel Galiano. Legal notice
What has to happen before “independently reviewed” may be claimed.
An external architecture, product and cryptography review is planned but not yet commissioned. This shows what is already in place and what is still open – without dates that do not exist yet.
- 01Reporting path and advisory registerIn place
Responsible disclosure and a public security-advisory register are in place, so findings have an orderly route.
- 02Review materialIn place
Protocol mappings, test vectors and implementation material exist and can be provided within a confidential review.
- 03Define the scopeNext step
Which version, which deployment model, which test data, what is excluded, how retesting works and how results are published.
- 04Select and commission reviewersOpen
Depends on scope and budget.
- 05Review, remediation, retestOpen
Findings are fixed and retested before any result is published.
- 06Publish the resultOpen
Bound to scope, version and date – never as a blanket “certified”.
Each step will be added here with its date once it is reached.