Desktop client
Electron 43 wraps a React 19 renderer. A narrow preload bridge keeps the renderer away from Node, while Web Crypto encrypts content before it leaves the device.
Electron · React · TypeScript · Web Crypto
Technical architecture
Three service planes. One privacy boundary.
Concord Voice is a desktop-first communications system designed so that messages and media are encrypted on the client, then routed by services that do not need to see their plaintext.
System at a glance
Desktop client
├── HTTP + WebSocket ──> Control plane ──> PostgreSQL · Redis · object storage
└── Socket.IO + WebRTC ─> Media plane ────> Redis
│
NATSControl plane
Go and Gin own authentication, permissions, community state, and the WebSocket hub. It persists application state and relays ciphertext; it does not need message plaintext to do its job.
Go · Gin · PostgreSQL · Redis · NATS
Media plane
Node.js and mediasoup negotiate and route live media. RoomManager owns the transport lifecycle, with one router per room and encrypted frames kept opaque to the SFU.
Node.js · mediasoup · Socket.IO · WebRTC
Data flow
Follow the path that matters to you.
Each view keeps the implementation detail visible without turning this page into the full architecture reference.
Signal rail
A short-lived session, then a narrowly scoped real-time connection.
Authentication establishes identity before the client asks for access to real-time services.
- Desktop clientSends credentials to the control plane over TLS.
- Control planeVerifies the password with Argon2id and completes MFA when required.
- SessionReturns a memory-only access token; Remember Me uses OS-backed secure storage for refresh material.
- WebSocketThe client requests a 30-second, single-use ticket before opening its real-time connection.
Boundary: The renderer does not receive broad operating-system access, and the access token is not written to disk.
Signal rail
The hub routes ciphertext. The recipient decrypts it.
Message encryption happens before the WebSocket envelope is sent; the server validates and stores the encrypted result.
- Sender deviceencryptForChannel encrypts plaintext with AES-256-GCM before it enters the network path.
- WebSocket hubChecks membership, the key epoch, and envelope limits without inspecting message content.
- PostgreSQLStores ciphertext verbatim alongside the metadata needed to deliver and order it.
- Recipient deviceValidates the inbound event, then decrypts locally with the channel key.
Boundary: The control plane has the routing and authorization context it needs, but not the plaintext it would need to read a conversation.
Signal rail
The SFU routes live media without becoming a media reader.
Signaling and media routing are separate from the client-side transform that encrypts each frame.
- Desktop clientAttaches the E2EE transform before publishing audio or video.
- Socket.IONegotiates WebRTC transports with the mediasoup media plane.
- Media planeRoomManager owns transport lifecycle; the SFU forwards opaque encrypted RTP frames.
- Other devicesDecrypt frames locally; missing transforms or keys fail closed instead of exposing media.
Boundary: DTLS-SRTP protects transport to the SFU, while application-layer E2EE keeps frame content and frame keys out of the SFU.
Signal rail
Membership changes are also encryption-boundary changes.
Channels and DMs keep parallel epoch ledgers so removed members cannot keep using a superseded key.
- Channel creatorGenerates an AES-256-GCM channel key on the client.
- Per-member wrappingWraps that channel key with each recipient public key using RSA-OAEP.
- Control planeStores wrapped keys and tracks the key epoch plus revocation records.
- Join or removalExisting members re-wrap or rotate key material for the current membership set.
Boundary: The service can store and distribute wrapped key material and enforce epochs, but private keys are generated and unwrapped only on client devices.
Privacy boundaries
Encryption is structural
There is no server-side plaintext message store to switch off later. The service handles encrypted content, while recipients decrypt on their own devices.
Privilege stays narrow
Electron isolates the renderer from privileged APIs, and the control and media planes each have a focused job instead of sharing a single all-powerful process.
Operations are deliberately low-detail
Optional operational metrics are signed, fixed scalar snapshots. They exclude user identifiers and user-level data, room and server names, addresses, hostnames, and free-form Docker metadata.
Deployment
A hosted architecture built for privacy.
The hosted service uses the desktop client with Cloudflare-delivered renderer updates and a bundled app:// fallback. Its service planes include PostgreSQL, Redis, NATS, object storage, and TURN where needed.
Concord Voice source is public; the supported self-hosted installer and deployment guide are not publicly released yet. Commercial self-hosting requires a Concord Voice commercial license.
What is next
More places to use Concord. More ways to run it.
- Desktop is live today.
- Browser and mobile clients are on the way.
- Further deployment options, including Kubernetes and multi-region operation, remain future work.
Read the implementation
Start with the design. Verify it in the source.
The architecture document is maintained beside the implementation and names the responsible paths and components.