A little clarity
before you start.

Telbox is a voice-first messenger that remembers. Send a voice note and you get the transcript, the tasks, and the answer, and you can ask your own history anything. Turning your voice into something useful means our AI reads your words, so we say so out loud: it is listed as a reader inside the app, next to the people, and either side can switch it out of any conversation. Encrypted in transit, always.

Telbox is free to download and start using. Free includes encrypted messaging and calls, voice notes with transcription, and a monthly AI quota. Optional Telbox Plus is available on iPhone through an App Store subscription and lifts the monthly AI limits. Review the current price and subscription terms in the app. Pro and Business remain planned offerings.

iPhone and iPad on the App Store, Android in active beta, and a web app for messaging and voice notes. Calls are not yet available on web. Read-sync across your devices is built in. Get the app →

Telbox is built around your voice, notes come back as summaries, tasks, and searchable conversation history when AI is enabled. It's also built for AI agents that run as cryptographically verified participants inside the encrypted chat. If you're asking about privacy specifically, read How is this different from Signal? below, the honest answer is not a comparison. See the features →

When AI is on, which is how your account starts, yes: your content is decrypted on our servers to run the AI, then handed to an AI provider we contract with. When you switch AI off for a conversation, no. Your app stops sealing a key to the AI processor and the server refuses the send if it tries, so no wrapped key is written and there is nothing on our side to decrypt with. Two bounds we'll give you before you ask: the switch is forward-only, and the processor's own private key stays in our database either way.

Transport, always, on every tier. Messages are sealed on your device with X25519 and AES-256-GCM, signed with Ed25519, and travel encrypted between your device and the recipient's. We never see plaintext in transit. Where we have to be precise: when AI is on, our AI processor is one of the cryptographic endpoints, it is a recipient device in the envelope, and the worker decrypts to run the AI. That's what the off switch takes away. How it works →

It isn't a privacy comparison and we're not going to make one. Signal has no server-side AI, so on that axis they're stronger and we'll say so. Telbox is a different product: a messenger where the AI turns your voice into transcripts, tasks and answers. What we owe you for that is disclosure and control, we name our AI as a reader inside the app, and either side can switch it out of any conversation. If you want a messenger with no AI at all, that's a legitimate choice, and it isn't us.

Yes. It's on from account creation, and there's no screen that asks you first, we'd rather tell you that than call it opt-in. What you get instead is control that actually reaches: off per conversation with either side able to set it, off account-wide, and one tap to wipe what it remembers.

Two switches. Per conversation: either side can switch the AI out of a chat, and it applies to both. Your app stops sealing the message to the AI processor and the server refuses the send if it tries, a change in who the message is encrypted to, not a setting we promise to honour. Or everywhere: from then on the server drops the AI processor from the recipient list, so nothing you send afterwards carries a key it can open. Both are forward-looking, not retroactive, what you sent while AI was on stays as it was, and Clear AI memory wipes what the AI made of it.

No, and we won't imply it does. The switch is forward-looking: from the moment you flip it, nothing you send carries a key the AI can open. Messages sent while it was on keep theirs, and the derived layer, transcripts, summaries, the facts it inferred, is dealt with by Clear AI memory, which is a real delete in one transaction and reports the count per table.

That's the honest limit. Your account switch governs what you send. If the person you're talking to has AI on, their side of the conversation is still processed. The lever that reaches both of you is the per-conversation switch, either member can set it and it binds the thread. And in a direct chat, if they've turned AI off, the header tells you. No chip means we're not telling you either way, not that they have AI on.

Our AI worker decrypts it, and it goes to an AI provider we contract with under terms that bar training on your content. We won't name the provider, that's deliberate, so the guarantee stands on the mechanism rather than on borrowing someone else's brand. It's the same pipeline on Free as on Business; tiers buy usage, not privacy. Two more readers you should know about, because "who else" deserves the whole list: if the person you're messaging runs an Automation that matches on content, their Automation reads what you sent, their setting, not yours. And a third-party app either of you has connected can hold a scope that returns raw message content. You can see and revoke connected apps in Settings; the honest summary is that your plaintext is governed by both ends of the conversation, not just your end.

No. The AI that processes your content is contractually barred from training on it, that's the mechanism, and we state it that way rather than as a bare slogan so it can't be read as "no processing happens." Processing does happen: when AI is on, the worker decrypts to run it. The pipeline is identical on every tier, Free included, so there is no version of Telbox where your content is worth less to us.

No. One AI path for every tier, identical terms on Free and Business. Tiers gate cost and usage, never privacy. The older "privacy premium" framing is retired, and it was wrong.

No. Today the Trust Center shows you who can read a conversation right now, not a history of when it did. That's the obvious next question after we list our own AI as a reader, and it's the top thing this position obliges us to build.

Call media is encrypted end-to-end with DTLS-SRTP; our relays forward encrypted media and can't decode it. Separately, post-call AI insights are a distinct switch, and when it's armed your own mic audio is uploaded during the call. The app can show you exactly what will be captured before you answer, and one tap skips AI for that call. Mid-call on a one-to-one you can stop it, and what was already uploaded is pulled out of processing, nothing further is transcribed or summarised from it, including a segment another participant's device captured of your voice. That mid-call control is one-to-one only today; it isn't available on group calls.

Not today. DTLS gives you encrypted media, but the fingerprints that bootstrap it are relayed by our server and aren't bound to your identity keys, so a compromised signalling server is in scope for call media. The per-call safety code in the UI is not functional. We'd rather say that than let you read the padlock as more than it is.

No, and we're not going to dress it up. Each message uses a fresh ephemeral key on the sender side, but the recipient side is a long-lived device key, so a compromised device key exposes that device's stored history. There's no ratchet in the shipping path. It's the biggest cryptographic gap we have.

Rolling out. The envelope is hybrid, classical X25519 combined with ML-KEM-768, the NIST standard, so an attacker has to break both, and a conversation upgrades automatically once every device in it supports it. It reached testers, not the public store, and older iPhones stay classical for now. Note the scope: post-quantum protects the wire and the stored ciphertext. It does not change what our AI reads.

On iPhone, your history and media are protected by the system's file encryption, and your device keys are held in the keystore marked non-exportable, so they don't restore to another phone from a backup. On Android the database file itself isn't encrypted today, selected fields are, but an attacker with filesystem access on a rooted device can read previews and metadata. That's a real difference and we won't paper over it.

On iPhone we detect, we don't prevent, iOS gives no API to block a screenshot, so what we can do is tell the sender it happened, and attribute it to the right one-time photo. On Android the one-time photo genuinely can't be screenshotted.

When you record a voice note live in the Telbox app on iPhone or Android, your device signs it with the same key it already uses to sign your encrypted messages — no new key, no enrollment. The recipient's app checks that signature and shows "Verified voice" when it can confirm the note was recorded on your device and hasn't changed since. It's on every plan, not a paid feature. Voice notes made outside the app's live recorder — forwarded, imported, played on web or Mac, or generated by an assistant — aren't signed and show no badge. It is not deepfake detection, not voiceprint matching, and it doesn't judge whether the speech itself is genuine — it confirms which device recorded the bytes and that they weren't changed, nothing more.

Phone-OTP is the primary sign-in path and we don't ship a registration lock or account PIN today. Passkeys are supported, but they're additive, the OTP path stays open on the same screen, so they don't raise the floor against a SIM swap. That's a gap, and we'd put it near the top of the security backlog.

Not yet, and we're not going to call it auditable until it is. The primitives are standard, X25519, AES-256-GCM, Ed25519, and they're implemented across four codebases against one shared set of test vectors, so the stacks are checked against each other. But there is no published third-party audit, and the verifier for our signed-institution envelope format is not something you can reach today. Those are both things we owe you, not things we can claim.

Yes, a developer platform, currently in preview. Build AI agents that run as verified participants, send messages and voice notes, read and summarize threads, and reach the world through MCP both directions. Explore the platform →

Every Telbox agent has its own cryptographic identity. Its messages are signed and verified on your device, so a "verified" badge is a proof, not a label anyone can fake. Revoke an agent and every message it ever sent loses its badge, retroactively.

Full documentation lives at docs.telbox.ai, with first-class Python (pip install telbox) and TypeScript (npm i @telbox/sdk) clients generated from the same OpenAPI spec. Self-serve keys land with the preview, request early access →.

Describe what you want in plain language, the @build compiler turns it into a typed, validated agent you can preview and create. Or start from one of 10 templates. Every agent begins draft-only; you grant authority per capability with hard limits.

Yes. Telbox speaks the Model Context Protocol both directions: your agent can consume external MCP servers, and every published agent is itself an OAuth-gated MCP endpoint callable from any MCP-compatible client.

Free covers encrypted messaging, calls, verified voice notes, and a monthly AI quota. Plus lifts monthly AI limits and adds 30-minute notes, up to five devices and 50 GB of cloud archive. Pro and Business are planned offerings; their descriptions on the pricing page are not current iPhone purchase options. Tiers gate cost and usage, never privacy. See pricing →

Two products: the Voice Workforce ($99/seat/mo), team-wide voice memory you can search, and the Voice Cloud API for embedding Telbox's verified voice + AI in your own product. Learn more →

Your own private Telbox for a family, team, or community, everyone in the space gets everything in Plus, plus AI for the whole circle with no monthly limits, run by you. 5 seats are included; add more at $12/seat. Coming soon, planned $99/mo, billed on the web. See pricing →

A self-hosted deployment for banks and institutions, designed so data stays in your cloud and Telbox acts as a trust broker rather than a data processor. Customer-managed key custody (your KMS) is on the roadmap. Details →

Telbox is operated by Telbox AI Labs LTD, registered in England and Wales, United Kingdom, with English and Arabic support today.