Core Platform Suite • tambayan.virtualofficeapps.com Live
Tambayan Enterprise.
Zero-Trust Collaboration & Merkle Ledger.
Air-gapped, zero-trust enterprise team collaboration and incident response platform. Powered by native client-side Web Crypto AES-256-GCM encryption with 100,000 PBKDF2 rounds, peer-to-peer WebRTC audio/video incident bridges, zero-trust encrypted file vaults, and a cryptographically chained Merkle audit ledger for SOC 2 Type II compliance.
Cryptographic Schema
Zero-Knowledge In-Browser Key Derivation.
Tambayan eliminates server-side exposure by moving all key derivation and authenticated encryption routines completely inside the client's browser runtime using W3C Web Cryptography APIs.
100,000 PBKDF2 Key Derivation Rounds
Channel passphrases are stretched into 256-bit AES cryptographic keys using 100,000 iterations of PBKDF2 with SHA-256 and unique salts, decisively mitigating GPU-accelerated brute-force attacks.
Chained Merkle Audit Ledger
Every message, file upload, and membership change creates an immutable cryptographic hash linked to the prior block (ΔBlocki = SHA256(Blocki-1 ‖ Payloadi)) for tamper-evident SOC 2 compliance.
WebRTC P2P Mesh Incident War Rooms
Instant 1-click video and audio war rooms establish peer-to-peer WebRTC connections directly between responders, bypassing central recording servers.
// Tambayan Enterprise — Web Cryptography AES-256-GCM
export async function deriveChannelKey(
channelId: string,
customSecret?: string
): Promise<CryptoKey> {
const enc = new TextEncoder();
const secret = customSecret || `tambayan-chan-vault-${channelId}`;
const raw = enc.encode(`${channelId}:${secret}`);
const baseKey = await window.crypto.subtle.importKey(
'raw',
raw,
{ name: 'PBKDF2' },
false,
['deriveKey']
);
return window.crypto.subtle.deriveKey(
{
name: 'PBKDF2',
salt: E2EE_SALT,
iterations: 100000,
hash: 'SHA-256',
},
baseKey,
{ name: 'AES-GCM', length: 256 },
true,
['encrypt', 'decrypt']
);
}Enterprise Capabilities
Engineered for the Modern Technical Workforce.
Zero-knowledge cryptographic security combined with high-performance real-time coordination, incident bridges, and sovereign auditability.
Zero-Trust Wire Scrubbing
When messages carry encrypted payloads, the server unconditionally purges plaintext content to empty strings before WebSocket re-broadcast or database write.
WebRTC Mesh Incident Bridges
One-click incident call bridge with bidirectional synchronization between channel threads and task activity streams with peer connection telemetry.
AES-256-GCM File Vault
Zero-trust file storage with unique per-file initialization vectors, on-the-fly streaming decryption, and SHA-256 integrity checksum verification.
5-Column Kanban & Timesheets
Integrated project management with live stopwatch time tracking, historical sprint burndown curves, and 40-hour weekly team capacity planning.
UltimaPBX Telephony Bridge
Bi-directional telephony synchronization with ticket ingestion, extension routing, and real-time SIP alert dispatch directly into channel threads.
Channel Canvas & Runbooks
Collaborative split-screen markdown runbooks living in every channel header with live interactive checkbox tracking and 1-click vault snapshotting.
Technical Evaluation
Cross-Platform Security & Architecture Matrix
Side-by-side engineering comparison showing why Tambayan's client-side zero-trust architecture surpasses conventional cloud-custody collaboration platforms.
| Architecture Dimension | 🛡️ Tambayan Enterprise | Slack Enterprise Grid | Microsoft Teams | Signal Desktop |
|---|---|---|---|---|
| Encryption Standard | WebCrypto AES-256-GCM | TLS + AWS KMS at rest | TLS + Cloud HSM at rest | Signal Protocol (Curve25519) |
| Key Derivation & Stretching | PBKDF2 (100k rounds, SHA-256) | None (SaaS Master Key) | None (Tenant KMS Key) | HKDF Ratchet |
| Private Key Custody | 100% Client-Side In-Memory | Vendor / Cloud Provider | Microsoft Azure Cloud | Client Device Storage |
| Tamper-Evident Audit Ledger | Chained Merkle Hash Ledger (SOC 2) | Standard SQL Append Log | Purview Audit Log | None (Zero Audit History) |
| Incident Video / Audio War Rooms | P2P WebRTC Mesh (Zero Relays) | Cloud Huddles SFU Relay | Azure Media Services Relay | RingRTC / SFU Bridge |
| Zero-Trust Encrypted Drive Vault | Per-file 96-bit IV AES-GCM | S3 Server-Side Encryption | SharePoint / OneDrive | Encrypted Media Attachment |
| Integrated Project & Task Kanban | 5-Column Kanban & Timesheets | Slack Lists / Third-Party | Microsoft Planner / Loop | Not Supported |
| Air-Gapped & Self-Hostable | Yes (Zero SaaS Dependencies) | No (SaaS Only) | No (Cloud Only) | No (Federation Complex) |
Frequently Asked Questions
Clear Answers for Technical Leaders & Security Officers.
Learn how Tambayan maintains sovereign zero-trust key isolation, handles multi-region offline continuity, and integrates into air-gapped infrastructure.
🛡️ Security Whitepaper & Audits
Inspect automated cryptographic test harnesses, PBKDF2 stretching specifications, and SOC 2 Type II audit report attestations.
Launch Tambayan LiveTambayan executes all key derivation and cryptographic cipher routines directly inside your browser runtime via native W3C Web Cryptography APIs (SubtleCrypto). When you select a channel or input a passkey, 100,000 PBKDF2 iterations derive a 256-bit AES-GCM key in local volatile memory. The plaintext content never touches the wire; only the ciphertext, initialization vector, and authentication tag are transmitted to the WebSocket relay and database.
Every encrypted message, file storage operation, and team membership event creates a cryptographic block linking back to the prior block's hash: Block_i = SHA-256(Block_i-1 || Payload_i). Any tampering, omission, or unauthorized modification immediately breaks the cryptographic signature chain. Auditors can verify and export verifiable JSON merkle proofs directly from the admin compliance portal.
Yes. Tambayan is engineered with zero external SaaS dependencies. The frontend leverages native browser WebCrypto APIs without calling external telemetry or font endpoints, and the backend operates seamlessly with local PostgreSQL 17 or SQLite storage. It is fully deployable behind air-gapped firewalls or on isolated Kubernetes clusters.
Unlike traditional platforms that route all audio and video streams through central SFU cloud servers where traffic can be captured, Tambayan uses a direct peer-to-peer (P2P) WebRTC mesh for incident bridges. Media streams are encrypted via DTLS-SRTP directly between participants, ensuring zero cloud interception.
Tambayan connects directly with UltimaPBX for bi-directional telephony alerts and ticket ingestion, and synchronizes with Manom for respectful, zero-keystroke workforce telemetry. Cross-platform workflows communicate via cryptographically signed webhooks and event streams without violating air-gapped data sovereignty.
tambayan.virtualofficeapps.com
Continuously integrated and automatically deployed on every commit to main. Secured by Cloudflare SSL, universal edge routing, and zero-docker PostgreSQL resilience.