Sovereign software, end to end.
PlausiDen designs, builds, and operates its own stack — mail, web, identity, AI, storage — and holds every decision to six axes at once: fast, reliable, robust, secure, anonymous, private. Most engineering picks two or three and trades the rest away. Refusing that trade is the founding constraint of everything here.
Services operating today.
These are not roadmap items; they run in production on PlausiDen-operated infrastructure.
Hosted email — full-stack mail with 100%-green authentication DNS (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DNSSEC, CAA), archival capture, snapshot backups with rehearsed restores, server-side sorting, and a self-audit harness that runs on every configuration change.
Web hosting — Rust-served sites behind strict security headers and modern TLS, with an onion-service presence.
Sovereign Workspace — a self-hosted, zero-trust collaboration stack: Matrix chat and calls, Nextcloud files, single sign-on, ERP, CRM, and remote management. FOSS end to end, on owned hardware.
Flagship projects.
Each is independently auditable and built on the same substrates — typed contracts, adversarial validation, accessibility and dual themes by default.
ThunderCrab
A Rust-native, sovereignty-first email client — Android-first with desktop and CLI. IMAP push, Markdown-native mail, RFC-correct threading, consent-only read receipts, and post-quantum hybrid TLS already shipping.
Forge + Loom
The website substrate: typed content in, accessible CSP-strict dual-theme sites out. Every production PlausiDen site is derived from it rather than hand-coded.
Mailroom
Mail-server configuration as a typed substrate: Rust sources emit validated Sieve and mailbox layouts, with spam-training watchers and a rehearsed-restore audit harness.
SacredVote
Verifiable, privacy-preserving civic voting research: post-quantum ballots, WebAuthn, zkTLS, and a post-quantum Belenios line of work.
Privacy Suite
Plausible deniability as engineering: a deniable filesystem (hidden volumes, ML-KEM, Shamir), plus fragmenting, distribution, cleanup, and monitoring layers — possession proves nothing.
Local-first AI
CPU-viable, federated-by-design neurosymbolic AI. Deterministic systems first; learned components as auditable, fail-closed augmentation — no cloud dependency.
Track record.
A business mail platform in production since May 2026 with fully green authentication DNS and automated restore drills. Production websites served from owned infrastructure. Nine tagged ThunderCrab releases with tag-to-APK release automation. Over 1,200 tests green across the website substrate, including a pixel-level site-reproduction harness. A session classifier deployed at zero false positives and zero false negatives across 1,182 real transcripts. Tens of terabytes of encrypted ZFS under snapshot discipline backing all of it.
The honest banner.
Most public PlausiDen repositories open with a deliberate warning: DO NOT USE — UNVERIFIED. Code is published for transparency and third-party audit from day one, while the Adversarial Validation Protocol withholds the fit-for-use claim until verification passes are actually earned. We would rather show unfinished work honestly than finished-looking work falsely.
Read the full overview.
The canonical ecosystem overview — goals, every project family, capabilities, and the complete index — lives in the open.
This site is open source.
plausiden.com is a zero-state Rust application — Axum and Maud, privacy-first. Audit the code that served you this page.