ZShield-protected secure calling
Private calls with a CallChat-owned protection layer.
The hosted CallChat Shield client runs voice and video through owner-controlled MatrixRTC, self-hosted LiveKit, and TURN. Before a protected call can start, ZMath Auto requires the shared passphrase and exact pattern, then derives a room-scoped media factor in memory for the frame-encryption path.
- Call control
- MatrixRTC
- Media service
- Self-hosted LiveKit
- ZMath factor
- Required in memory
- QPU option
- Separate hardware-linked factor
Protection active now
A call path designed to fail closed.
The CallChat client requires the shared passphrase and exact pattern before preparing a protected call.
ZMath Auto derives a 256-bit media factor for the Matrix room and keeps it in browser memory.
The hosted MatrixRTC/LiveKit profile combines the ZMath factor with rotating media-key material for frame encryption.
Matrix-only mode, a locked ZMath session, or a missing room factor blocks the protected call path.
Operational IonQ factor
A separate factor that the selected encryption profile actually requires.
The owner browser creates a fresh 256-bit nonce and sends only its SHA-256 commitment. CallChat runs a bounded circuit on the approved IonQ backend, validates the completed result, and returns a domain-separated measurement digest with the job evidence.
The browser combines its local nonce and the validated result with HKDF-SHA-512 to create a 256-bit factor. That factor changes the ZMath call media root and is required to reproduce matching room keys. IonQ and the CallChat server never receive the nonce or final factor. This is hardware-linked key derivation, not QKD or a claim that IonQ encrypts live media.
Protected call sequence
From verified room to protected media.
- Verify the Matrix identities. Start from a trusted direct message or encrypted room in the CallChat Shield web client.
- Unlock ZMath. Enter the shared passphrase and import the exact pattern on each participating device.
- Start voice or video. CallChat derives the room media factor and hands the protected context to the self-hosted call widget.
- Confirm the call posture. Check ZShield status, participants, device verification, and relay behaviour across separate networks.
Licensed secure communications
Deploy Q Call on infrastructure you control.
Q Call combines a proven Matrix foundation with the CallChat Shield client, ZMath-protected files, protected call controls, owner-managed AI routing, and an optional IonQ hardware-linked factor. One approved public server IP includes unlimited users for USD 55/month or USD 550/year.