ENCLAY is one app with two tools. A firewall that stops stalkerware and spyware on your phone from reporting back. And an encrypted chat that goes straight to the people you trust, with no server, phone number or account in between.
NCSAI C3IR & 
ARPSyndicate
Being watched through your phone usually comes down to two things: something on the phone that reports on you, and conversations that pass through someone else's hands. ENCLAY deals with both, on the phone itself.
Stops what's already on your phone from reporting back.
Talks to the people you trust, with nothing in the middle.
Use either one, or both. They share one thing: everything happens on your phone. We run no servers, we have no account for you, and we can't see what you do.
ENCLAY was built for people whose phone may be working against them, and for the people who help them.
Stalkerware is usually installed by someone close: a partner, an ex, a family member. Turn on the firewall and run a Safety Check. If it finds something, don't uninstall it yet: that can alert whoever put it there. Cut it off and export a safety report first.
Meet once and scan each other's code. From then on, messages go only between your two phones. No server keeps a copy, and no phone number ties the chat to you. Verify the safety code and set messages to disappear.
It needs no account or email, and works in English and Hebrew. Findings become a PDF you can work from. Stealth mode disguises the app as a calculator, and you get a safe channel to stay in touch with the people you support.
Nearby carries encrypted messages over Bluetooth, phone to phone, even through other ENCLAY phones in between. No Wi-Fi, no mobile data, no towers needed.
Most messengers, even encrypted ones, send every message through a company's servers, and know your phone number, your contacts and when you talk. ENCLAY has no servers. Your phone talks to theirs.
One of you shows an ENCLAY code, the other scans it. It works once and expires in 24 hours. It's styled light-on-dark, so most ordinary QR scanners can't even read it. There's no username to search for and no number to look up: nobody can message you unless you've met them.
Your phone runs a separate Tor onion service for every contact, and only that contact holds the key to reach it. A stranger, or even another of your contacts, can't knock on it.
Messages use Signal's protocol through libsignal: PQXDH key agreement (X25519 + Kyber-1024, resistant to future quantum computers) and the Double Ratchet. Each envelope is then sealed again and padded, so nothing on the wire shows its size, type or sender.
If their phone is off, the message waits, encrypted, on yours, and goes the moment it's back, for up to a week. With no internet, Nearby carries it over Bluetooth, hopping through other ENCLAY phones if it has to.
Set per conversation, from 5 minutes to a week. Both phones delete them.
Scan each other's code, or read 60 digits aloud. If they match, nobody is sitting between you.
Take your phone off Tor whenever you like. Messages wait on their side until you're back.
Messages ask for your fingerprint, face or screen lock again every time ENCLAY leaves the screen.
Chat screens can't be captured or recorded, and nothing is ever copied to cloud backup or a new phone.
Deleting a conversation destroys its keys and tells their phone, and the private address closes for good.
A quiet notification keeps your onions online so contacts can reach you. In stealth mode it only says "Sync is running".
The whole app, every message bubble right-to-left or left-to-right by its own text.
Stalkerware isn't a virus. It's a product, sold openly as "parental monitoring", and installed on purpose by someone with access to the phone. Antivirus mostly misses it, because it's working exactly as designed. But one thing it can't avoid: it has to send what it collects somewhere. That's where ENCLAY stops it.
A standard Android VpnService: no root, no exit server. Every app's traffic passes through a local tunnel that only ENCLAY sees.
DNS, TLS ClientHello, SNI and certificates. Encrypted DNS is forced back to plain DNS, so a block can't be routed around.
Public feeds plus our own threat intelligence, merged on the phone. No lookup ever leaves it.
A match gets an immediate RST, as if the server had said no. Everything else goes through, and is logged for you to see.
Every installed app is checked by package name and signing certificate against 646 packages from 158 vendors. A dormant install with no traffic yet still gets flagged.
Spyware checks in on a timer. ENCLAY notices when an app contacts the same place with machine-like regularity.
Flags a new destination that appears minutes after an app gets the camera, microphone or location.
Paste a link before you open it. ENCLAY loads it in a sandbox and shows every request it really makes.
Every finding in one PDF, with one tap: made for a shelter, a lawyer or the police.
A "charger" that turns out to be a keyboard? All traffic is cut the instant it plugs in. Opt-in.
76,000+ IPv4 and IPv6 ranges and 3M+ malicious domains, merged from public and proprietary feeds into one local index.
Flags a connection by the exact shape of its own outbound TLS handshake, catching known-bad clients even on an unlisted IP.
Opt-in: actively probes a new TLS destination with ten crafted handshakes to identify C2 frameworks like Cobalt Strike or Metasploit by server fingerprint alone.
DoH and DoT are forced back to plain UDP:53, so DNS-based evasion can't quietly slip past domain rules.
Refuse all traffic to or from an entire country, enforced against the same on-device GeoIP index used for display.
Cross-references every installed app, by package name and by APK signing certificate, against 646 packages from 158 known commercial stalkerware and monitoring-software vendors. Catches a dormant install with no suspicious traffic yet, and renamed variants that reuse a known vendor's signing key.
A separate known-package and signing-certificate index for infostealers, banking trojans, and RAT builder tools, matched the same way as the stalkerware scan. Kept as its own list on purpose: a different threat category deserves its own honest coverage, not one badge for two different risks.
Blocks known cryptocurrency mining-pool domains and IPs, and treats a connection on a common Stratum mining-pool port as a corroborating signal alongside other suspicious traits, never a verdict on its own.
Flags apps granted the ability to draw over other apps' windows, the exact mechanism banking-trojan malware uses to paint a fake login screen on top of a real one. Legitimate chat heads and screen dimmers use it too, so this only escalates when paired with another signal.
Android allows only one active VPN tunnel at a time. Flags installed apps that could themselves run one and silently displace ENCLAY's own tunnel, taking over your traffic with no visible warning.
Command-and-control clients and most stalkerware "phone home" on a timer, not on demand: check in every few minutes, upload, wait, repeat. ENCLAY watches the interval between an app's connections to the same destination and flags the pattern when it's suspiciously regular, the way a person's real usage rarely is.
Clusters a browser's rapid burst of connections to different hosts into one navigation chain, and flags it if any hop led to known-malicious infrastructure. Scoped to actual browser apps, not background app traffic.
Flags a new destination that appears within minutes of a sensitive permission grant (camera, microphone, or location), a common signature of data being collected and immediately shipped out.
Every connection, every app, in real time, searchable by host, IP, organization, country, or threat category.
Per-app host history, data usage, and connection patterns, isolated from the rest of the device's traffic.
Flags infrastructure registered days, not years, ago, one of the more reliable phishing and malware tells.
Tells you when a destination sits on bare cloud/VPS infrastructure instead of a named, recognizable service.
Subject, issuer, expiry, and self-signed detection, read directly from the live TLS handshake.
Opt-in: resolves a blocked domain's real IP purely for display, so a DNS-level block still shows a real IP and ASN instead of the meaningless in-tunnel address.
A newly installed app gets its permission snapshot the moment it lands, not after waiting up to an hour for the periodic scan — no blind spot in that app's permission timeline from minute one.
Enriches the new-destination-after-permission-grant signal with how long the app had sat quietly installed before asking: a permission granted the day an app was installed reads very differently from the same grant six months in.
A domain that has consistently used TLS 1.3, invisible to any inspector, suddenly showing a visible certificate has almost no innocent explanation: most proxy-based interception tools (a pushed workplace or parental-control certificate) can't see or rewrite an encrypted TLS 1.3 handshake, so they force a downgrade to see it. Flagged only once independently observed from more than one app, the same corroboration discipline used everywhere else here. It cannot see interception by a competing on-device VPN app — Android only runs one VPN at a time — and says so plainly rather than overclaiming.
Compares an app's upload volume today against its own recent daily average, catching a bulk data dump that happens at an ordinary time of day and would otherwise slip past timing-based detection entirely.
Notices when an app's own connection to a familiar domain resolves onto a network it hasn't itself seen for that domain recently. Deliberately scored as a weak, corroborating signal only: switching Wi-Fi networks and ordinary CDN failover produce the same pattern completely legitimately.
A BadUSB attack arrives disguised as a charger or cable, registers itself as a keyboard the instant it's plugged in, then types out commands before anyone can react. ENCLAY watches for exactly that signature: the moment any keyboard- or mouse-class device attaches, every connection already open is severed and all new traffic is blocked, device-wide, in real time, with an alert that stays in the notification shade until it's resumed by hand. Opt-in, since a keyboard plugged in on purpose trips it too.
Every detected finding, threat-feed matches, beaconing, permission-to-network correlations, known-stalkerware app matches, exports as one PDF with a single tap: built for handing to a shelter, a lawyer, or law enforcement, not just for your own reading.
Block or allow any host, app, or country the instant you see it. No separate settings screen required.
Let one app, a banking app that refuses to run under any VPN, bypass the tunnel entirely, without turning protection off for everything else.
Start or stop protection straight from the notification shade. No need to open the app.
Flags it up front when Android's strict Private DNS mode would silently break all connectivity the moment protection turns on, before you find out the hard way.
Pairs with Android's own "Block connections without VPN" setting for a true kill switch: if the tunnel ever drops, nothing gets through until it's back, instead of silently failing open.
Block everything on a schedule: no traffic in or out while the device should be asleep.
A notification confirms protection is active for as long as the firewall runs, and can't be swiped away while it's on. If the tunnel ever drops unexpectedly, you're flagged immediately instead of silently failing open.
Take your own connection history with you, per app, whenever you want it.
No account or cloud dashboard needed to use ENCLAY. Every block/allow decision is made on-device.
Checks its own APK signing certificate against the genuine release build on every launch. A mismatch means this specific install, not some other app, may not be trustworthy: someone with physical access decompiled it, patched out the blocking logic, and reinstalled a copy under the same name. Surfaced as its own banner, first, ahead of everything else, not buried in a list of findings about other apps.
Remembers whether protection was stopped from inside the app or revoked from outside it (system VPN settings, another VPN app taking the slot) and says which, next time you open it — no silent notification, just an honest answer once you're already looking.
If someone goes through your phone, a security app can itself become a risk. ENCLAY tries to stay out of sight, and never makes a dangerous move for you.
Changes the icon and name on your home screen to a plain "Calculator". It hides the app from a casual look, not a deliberate search, and the app says so.
ENCLAY never puts a message or a contact's name in a notification. In stealth mode, the one it shows says only "Sync is running".
Removing stalkerware can alert whoever installed it. ENCLAY cuts it off, keeps the evidence, then walks you through a safe-removal checklist.
On every launch ENCLAY checks its own signature. If someone patched it to stop protecting you, it warns you first.
Even on an unlocked phone, your chats ask for your fingerprint or screen lock again.
The button in the corner of this site, or the Esc key, takes you straight to a weather search. A private browser window leaves no history at all.
Real screens from a phone running ENCLAY 1.3, with made-up conversations.
Security tools oversell constantly. Here's what ENCLAY is built to do, and just as deliberately, what it isn't.
Nothing. No ads, no subscription, no account. There's no server behind ENCLAY to pay for, and nothing about you is collected or sold.
ENCLAY is a joint research project of NCSAI C3IR and ARPSyndicate. Write to us at hello@encryptlayer.net.
Yes, that's the plan. The chat is built on Signal's open-source libsignal, and we intend to publish ENCLAY's own source so anyone can check what it does.
Android 10 and later. There's no iPhone version.
ENCLAY uses Signal's encryption protocol, with post-quantum keys. The difference is what's around it: no company server in the middle, no phone number and no account. Each message goes from your phone straight to your contact's phone over a private Tor onion service, or over Bluetooth when you're close. You add contacts only face to face.
No. There's no ENCLAY server for them to pass through. They're encrypted on your phone and decrypted only on your contact's phone. We never see them, or who you talk to.
The message waits, encrypted, on your phone and goes as soon as theirs is reachable, for up to a week. You'll see "Waiting for their phone" until it's delivered. With Nearby on and the two of you close by, it can go over Bluetooth instead.
Not always. With internet, messages travel over Tor. Without it, Nearby carries them phone to phone over Bluetooth, through other ENCLAY phones if needed, still end-to-end encrypted.
Because that's the one way to be sure who you're talking to. Scanning in person exchanges keys directly, so no one can slip in between. It also means nobody can find you or message you unless you've met.
Your chats and keys are gone, by design: nothing is backed up anywhere. You become a new identity and add your contacts again in person. Updating the app from Google Play keeps everything.
Android pauses apps in the background. The notification keeps your private addresses online so your contacts can reach you. It says nothing private, and you can turn it off in Messaging settings; then you're reachable only while ENCLAY is open.
No. The firewall runs as a standard Android VpnService, the same mechanism any VPN app uses. It never asks for root and never modifies the system.
The firewall isn't. It uses Android's VPN slot to inspect traffic on the phone, with no exit server, so it doesn't hide your IP from the sites you visit. Only the chat travels over Tor.
Yes. It checks every installed app's package name and signing certificate against known stalkerware, infostealer, banking-trojan and remote-access vendors, so a dormant install can still be flagged.
It can. That's why ENCLAY doesn't uninstall apps for you. It cuts the app's network access first, lets you export a safety report as evidence, then walks you through a safe-removal checklist.
No. Every block or allow decision and all connection history stay on the phone. Nothing about your traffic is reported anywhere.
NCSAI C3IR and ARPSyndicate.NCSAI C3IRCyber Security Centre for Research & Innovations: research into the threats people actually face, and tools that answer them.
ARPSyndicateThe team behind Subdomain Center and Exploit Observer, two of the largest open threat-intelligence databases.
The people who need ENCLAY most often can't make an account safely, and can't trust a server they don't control. So there isn't one.
Questions, feedback, a security issue, press, or an organisation that wants help bringing ENCLAY to the people it supports.
If you think your phone or email is being watched, write from a device and an account the other person can't get into. We'll never ask for your passwords or for access to your phone.
No account, nothing to set up before the firewall starts working. Add your first contact the next time you meet.
