FC21

Architecture

Verifiable boundaries, not marketing audits

FC21 is security-critical software. This page describes the architecture at a high level — it does not replace an external cryptographic review, and it does not claim BSI or NATO certification.

Crypto statusFreeze (ADR-0010)
AuthArgon2id + sessions
RelayOpaque payloads

System components

FC21 Mobile

UI, local secure storage, protocol calls. No admin authority.

FC21 Core

Protocol state machine, ratchet, serialization. Algorithms via a reviewed provider.

FC21 Sovereign Node

Relay, prekey distribution, auth, entitlements. Message plaintext is not required.

FC21 Control

Organizations, devices, policies, audit — separate from personal conversations.

The billing boundary

Billing answers: may this organization use the service?

Cryptography answers: is this identity or message authentic and confidential?

These concerns are never merged (ADR-0002).

ADR-0002 — Billing boundary

Trust boundaries

  • Peer vs. platform: peers see pseudonyms; the server binds user_id internally.
  • Org admin ≠ personal: Control does not see personal or pseudonymous conversations.
  • Push is untrusted: APNs and FCM are a wakeup transport, not a trust anchor.
  • Invite secrets: CSPRNG, digest-only storage, rate-limited, no enumeration.

Crypto freeze

ADR-0010 freezes the cryptographic architecture. This milestone has no production sealer or opener. Development transport may use plaintext — that is not sold as a security feature.

Post-quantum resistance is a design path, not a shipped claim. No “quantum-proof” wording without an external review.

ADR-0010 — Cryptographic architecture and agility

Authentication and sessions

Sign-in: account identifier plus password. Sessions are bound to user_id. Device enrollment uses high-entropy secrets, digest-only on the server. Authentication failure is a hard failure — deny by default.

More detail: Recovery, Privacy.

What we do not claim

  • No BSI certification or NATO approval
  • No “externally audited” label without a completed review
  • No government deployments as a marketing fact
  • No claim of complete quantum resistance

See also: docs/product/fc21-de-website.md — claims policy

Sovereign deployment

FC21 is designed for sovereign deployment: organization-controlled identity, a crypto-agile architecture, and auditable security boundaries. Every major product feature must be operable in that mode (product principles).