The production API key is in a chat message from March.

Freehold is post-quantum credential and password storage you hold outright, and the peer-to-peer encrypted chat, calls and file transfer it grew out of. Your API keys, tokens and passwords are sealed one by one inside an encrypted vault on your own machine; a credential goes to a teammate as an offer over an ML-KEM-768 link straight into their vault, never through a server and never into a message history. There is no server, no account, no per-seat rent, and no third party holding your secrets or your metadata. The name is the thesis: a freehold is property you own outright rather than rent - which is exactly the difference between this and a cloud messenger subscription.

Yes - for the credentials a team actually passes around: API keys, deploy tokens, PATs, service passwords. They live in the same encrypted vault as your history, and the reason it belongs in a messenger is the failure it removes. The way a production key usually reaches a colleague is a chat message, a mail, or a ticket, and it stays there afterwards. In Freehold you hand it over the same end-to-end encrypted link, as an offer they accept - and it is never written into either side’s message history, so it cannot resurface in a transcript, an export, or a backfill to someone who was offline. Values are sealed one by one inside the already-encrypted file, so the running program holds ciphertext until you ask for a specific credential by name.

Three deliberate constraints. Credentials require the vault passphrase: every command is refused without one, and turning the vault off is refused while credentials are stored - a credential store that wrote production keys to a plaintext disk would not be a degraded feature, it would be a lie. A credential is decrypted only for as long as it takes to answer one request, so listing, searching and every export have never touched a plaintext value. And handing one over needs both people online, because there is no queue for a credential; a machine with no vault refuses to receive one and tells the sender why. What we do not claim: once you use a credential it is subject to everything on that machine, and once a teammate holds it, that copy is theirs - rotating yours does not reach it, which is why the app shows you who else holds each one.

Freehold is provided to MacTech clients through the client portal, with no per-seat rent and no vendor infrastructure to pay for. The comparison that matters is against a cloud password manager or secure messenger at roughly $5–15 per user per month, where retention, sharing and e-discovery typically live in a premium tier. Ask us for access; a pilot for a program team is the usual first step.

Two laptops on one network segment find each other in under a minute with zero configuration, using an identity-free discovery beacon. You can also run your own one-file bootstrap node that is never announced on any public network. Messages relay through teammates to people you never overlap with - carrying the original author signature, so a relayed message is still verified rather than merely trusted. Denied, disrupted, intermittent and limited connectivity is the design point, not the failure mode.

Every link runs Noise over X25519 plus an independent hybrid ML-KEM-768 layer - the NIST FIPS 203 standard - with a fresh key per message, periodic re-keying, and downgrade refusal. Traffic recorded today stays unreadable to tomorrow computers, which is the "harvest now, decrypt later" exposure post-quantum cryptography exists to close. This is ahead of CNSA 2.0 timelines rather than a future roadmap item.

One command exports a signed bundle - verified audit chain, roster policy, retention settings, crypto inventory - mapped to NIST SP 800-171 control families. A third party can verify it offline with nothing but Node.js. Drop it in an SSP or hand it to a C3PAO. Freehold also supports records channels where roster policy makes a channel append-only: deletion and self-destruct are refused on every member machine, and signed timestamped transcripts export on demand. That resolves the federal-records retention versus ephemerality tension the DoD IG has documented, instead of dodging it.

Identity, history, files and stored credentials are encrypted at rest with AES-256-GCM and a scrypt-hardened key, and the vault auto-relocks on idle - the browser is outside the trust boundary. A duress passphrase destroys everything and opens an innocent-looking empty account. A dead-man switch wipes an abandoned machine. There is a /burn command for a clean exit. The tradeoff is stated plainly: a forgotten vault passphrase has no recovery, because nobody else holds your keys.

No, and we will not claim otherwise. There is no IL4/IL5 or FedRAMP accreditation. Where a contract mandates an accredited tool, Freehold is the disconnected-operations, cross-org, records-honest complement to it - not a compliance substitute. It is built for program teams of tens of people, not thousands of seats. Anyone handling CUI should confirm usage with their FSO.

A team lead signs the member list and security policy with the same key that authenticates them. Policy - retention, expiry caps, banners, mandatory vault - is enforced by every member machine rather than suggested by a console. You can follow several rosters at once and the strictest policy wins, which is how a subcontractor on three primes programs works in practice. Cross-org collaboration is importing a signed roster file per team, not an admin-gated federation negotiated between two organizations.

About five minutes and no IT department. Version 1.2.0 is a desktop app: sign in to the client portal, download the installer for your machine (Mac on Apple Silicon or Intel, Windows x64), check the SHA-256 listed beside it if you want to, and open it. No Node, no Python, no admin rights. Then set a vault passphrase, swap UIDs with your teammates once over any channel you already trust, and you are operational. A team lead who wants managed policy exports one roster file; everyone else imports it.

Version 1.2.0 ships three desktop installers: macOS on Apple Silicon, macOS on Intel, and Windows x64. The app carries the web client and a full terminal client for people who live there. One identity works across up to eight machines, messages reach every device, and a stolen laptop is revoked account-wide and stops receiving ciphertext at all. There is no phone client yet, and we will say so in the first conversation rather than the last.

Because the 1.2.0 installers are ad-hoc signed rather than notarized, and the warning is accurate: your operating system cannot verify who produced the file. macOS will refuse the first open; right-click the app and choose Open, once. Windows SmartScreen will warn; choose More info, then Run anyway. The portal lists a SHA-256 for every installer so you can prove the file you downloaded is the one we published; that proves integrity, not authorship, and we would rather say so than teach you to click through prompts. Notarization is on the list.

A roster can name a successor inside its own signature. If the issuer can no longer sign, the named key issues the next version and every member accepts it - not because they trust the new key, but because the old key, while it still worked, signed that name into the roster they already hold. Team, policy and channel scope carry over, and members who were offline pick it up when they reconnect. Separately, any member can seal an encrypted backup of their identity, followed rosters and contacts with the same scrypt and AES-256-GCM as the vault. We state the sharp edges too: a successor is a delegation, not a backup - that key can take the team at any time - and whoever opens a backup file becomes you.