Open Arsenal

See the stars

OpenSignal Specification

Home / OpenSignal / OpenSignal Specification

OpenSignal

Connect Securely. Build Confidently.

OpenSignal is an open-source, cross-platform secure collaboration and communication platform designed around end-to-end encryption, privacy-first architecture, optional federation, and privacy-safe AI integration.

Specification

Core Vision

OpenSignal is built to function as a zero-knowledge collaboration network, where:

  • The server never sees plaintext data
  • All sensitive operations are encrypted client-side
  • Collaboration is real-time but privacy-preserving
  • Users retain full ownership of identity and data
  • Advanced features such as AI and federation never compromise encryption guarantees

Core Platform Features

End-to-End Encryption (E2EE)

  • All messages, files, and workspace data are encrypted on the client
  • Server only handles encrypted payloads for relay and storage
  • Client-side key management
  • Per-session encryption keys for collaboration
  • Optional device-bound key pairs

Real-Time Communication

  • Encrypted 1:1 and group messaging
  • Real-time presence indicators
  • Privacy-controlled typing and activity signals
  • Threaded conversations
  • Optional ephemeral messaging and self-destruct timers

Secure Workspaces

OpenSignal organizes collaboration into encrypted workspaces:

  • Chat, files, notes, and tasks unified in one space
  • Workspace-level encryption keys
  • Client-enforced role-based permissions
  • Multi-project workspace support
  • Shared encrypted history and context

Encrypted File Collaboration

  • Real-time collaborative document editing
  • Encrypted file storage
  • Encrypted version history
  • Differential synchronization
  • Conflict-free editing through CRDT models

Cross-Platform Support

  • Windows
  • macOS
  • Linux
  • Optional web client with capabilities determined by security mode

AI – Privacy-Safe Architecture

Local AI (Default Mode)

  • Runs entirely on the user’s device
  • No data leaves the machine
  • Conversation summaries
  • Task extraction
  • Code and document assistance
  • Workspace organization

Optional Encrypted Remote AI

  • Inputs are encrypted before transmission
  • Remote processing is designed to prevent server access to plaintext
  • Trusted execution environments may be supported
  • Encrypted prompt-processing pipelines may be supported
  • AI results are decrypted client-side

AI Safety Rules

  • AI is scoped per workspace
  • No cross-workspace data leakage
  • No training on user data by default
  • Cloud AI is fully opt-in
  • Local AI remains available for high-security environments

Federation System (Optional)

Federated Architecture

  • Self-hostable OpenSignal servers
  • Servers function as encrypted relay and storage nodes
  • Servers cannot access plaintext content
  • Optional federation between trusted servers

Identity System

  • Portable cryptographic identity keys
  • Multi-device identities
  • Cross-server authentication using public-key identities
  • Optional privacy-preserving aliases

Federation Modes

  • Private Mode: Single server or self-hosted deployment
  • Trusted Federation: Communication between approved servers
  • Open Federation: Distributed network model

Collaboration System

Real-Time Sync

  • CRDT-based conflict-free editing
  • Encrypted session synchronization
  • Multi-user simultaneous editing
  • Low-latency encrypted update propagation

Shared Context Layer

  • Encrypted workspace memory
  • Shared task lists
  • Collaborative planning boards
  • Persistent encrypted workspace state

Security Model

Zero-Knowledge Architecture

  • Server cannot decrypt user data
  • No plaintext storage on backend systems
  • Clients perform encryption and decryption

Transport Security

  • TLS 1.3 for network traffic
  • Encrypted handshake protocols for session creation

Plugin Security Model

  • Sandboxed plugin execution
  • Capability-based permissions
  • Restricted access to decrypted data
  • Optional signed plugin support

Plugin System

  • Modular plugin architecture
  • Integrations
  • UI tools
  • Workflow automation
  • Language support tools
  • Sandboxed execution environment
  • Marketplace-ready architecture

Version Control & History

  • Optional encrypted Git integration
  • Workspace-level history tracking
  • Encrypted commit storage
  • User-controlled audit history exports

Performance Goals

  • Lightweight client core
  • Fast startup
  • Scalability from individual users to enterprise teams
  • Efficient encrypted synchronization
  • Offline-first operation

Offline-First Design

  • Full workspace access while offline
  • Queued encrypted updates
  • Automatic synchronization when connectivity returns
  • Conflict-free merging of disconnected edits

Identity & Access Control

  • Cryptographic identity-based authentication
  • Device-level authorization
  • Optional multi-factor authentication
  • Client-enforced workspace access control

Data Ownership Principles

  • Users retain ownership of generated data
  • No platform-level access to decrypted content
  • Exportable encrypted backups
  • Portable identity and workspace data

Specification Branding License (SBL)

Standard

  • Fully AGPL-3.0+ compliant system
  • Copyleft enforced for network deployments
  • Required attribution:

Optional

License & Notice Requirements

OpenSignal is released under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).
By contributing to this project, you agree that your contributions will also be released under this license.

Please note the following:

  • All contributions must comply with the AGPL-3.0+ terms.
  • Under Section 7 of the license, all redistributions, forks, and derivative works must preserve attribution to Roxanne Ardary and roxanneardary.com.
  • OpenSignal specifications are free to use with attribution. A Specification Branding License can be negotiated upon request.
  • The project’s notice.md file tracks attribution requirements and contributor acknowledgments. Any update that adds new contributors or modifies attribution should also update notice.md.
  • When submitting a pull request, ensure that any new files maintain the attribution headers where applicable.
  • Network-deployed versions of this software must also remain fully AGPL-3.0+ compliant, including exposure of source code modifications when applicable under the license.

For full legal details, please refer to the AGPL-3.0+ license and the project’s notice.md file.

Notice – OpenSignal

Attribution Requirement: Under Section 7 of the AGPL 3.0+ license, all redistributions, forks, and derivative works, including network-deployed versions of this project, must provide attribution to Roxanne Ardary and roxanneardary.com.

Contributors

This file tracks contributors and their specific contributions to the project.

  • Roxanne Ardary, roxanneardary.com – March 10, 2026
    Created the repository for OpenSignal. Developed the core platform with end-to-end encryption, cross-platform support, and real-time collaboration features.
  • [Add other contributors here] – [Date]
    [Describe contribution in one sentence]

License – OpenSignal

This repository is licensed under the GNU Affero General Public License v3.0 or later (AGPL-3.0+).

Key Points

  • You are free to use, modify, and distribute the code.
  • All redistributions, forks, and derivative works or network-deployed versions must also be licensed under AGPL-3.0+ and provide attribution to Roxanne Ardary and roxanneardary.com as required under Section 7 of the license.
  • The software is provided “as is,” without warranty of any kind.

For the full license text, see GNU AGPL-3.0 License.

Related posts:

VectorIDE Specification

Sovereign

SafeForge