Operator-controlled storage
OneStop offers a Windows installer and a separate Ubuntu preview. The operator controls access, storage, retention, backups and integrations. Ubuntu remains a test-machine preview, not a production-qualified deployment.
Security & Trust
Security claims should come with scope.
Security properties vary by product. We document what each product is designed to protect, what data it processes, and where its stated boundaries end.
Different products, different security models.
Greenlyz does not apply one blanket encryption or privacy claim to its entire portfolio. Deployment, data handling, and release status are described separately.
Published messaging design
The Greenlyz-authored whitepaper describes an end-to-end encrypted messaging design with a content-blind relay and explicit threat boundaries.
Web platform controls
The Nooks is available on the web and Android, with public communities and private invite-only groups. It is not an end-to-end encrypted messenger or a self-hosted workspace.
Product support portal
The Greenlyz support portal is live. Do not include credentials or private files in support submissions. Availability as a separate self-hosted product has not been announced.
Published evidence
XecureCom’s documented trust model.
The current whitepaper specifies X3DH for session establishment and the Double Ratchet for message-key evolution.
These statements describe an in-development design. No independent audit or production guarantee is claimed in the published materials.
XecureCom / Content-blind relay designWhitepaper v12.3 · February 2026
Sender deviceEncrypts before sending
Blind relayForwards encrypted data
Recipient deviceDecrypts on device
Design says the relay cannot access
- Message content
- Contact relationships
- Private encryption keys
- File names, types, and sizes
- SOS coordinates
- Safety numbers
Design says the relay handles
- Encrypted ciphertext
- Public keys
- User and display information
- Approximate message size
- Delivery timestamps
- Account creation date
Documented boundaries
DESIGNED TO PROTECT
OUTSIDE THE BOUNDARY
OUTSIDE THE BOUNDARY
OUTSIDE THE BOUNDARY
What the design does—and does not—address.
Content in transit and at the relay
The documented design keeps plaintext message content and private keys on user devices.
Compromised devices
Malware, an unlocked device, or an attacker with endpoint access can expose data after it is decrypted.
Physical access
Device security, screen locks, backups, and user handling remain part of the user’s operating environment.
Global traffic analysis
The design does not claim to conceal every network-level pattern from a sufficiently capable observer.
Status matters. XecureCom is in development. Features and security properties described here reflect the current published design and may change before release.
OneStop controls
ACCESS
TRANSPORT
INTEGRATIONS
OPERATIONS
Self-hosting shifts control—and responsibility—to the operator.
OneStop stores its workspace on the computer or server selected by the operator. That provides direct control over deployment, storage, retention, and backup choices.
Passwords and optional passkeys
Administrators create accounts. Users sign in with account passwords or registered WebAuthn passkeys; protected settings can require recent verification.
HTTPS for remote access
Use trusted HTTPS for remote access, including phones and Desktop Sync. Plain HTTP is restricted to localhost; a trusted LAN is not an exception.
External services are optional
Google Drive, OneDrive, email, weather, and push integrations can exchange data with their respective providers when enabled.
Backups remain your decision
The operator is responsible for access policy, software updates, backup protection, and physical server security.
How to read our claims
Documentation is evidence—not a substitute for verification.
Greenlyz uses three labels to make the maturity of a statement clearer:
- Available: a product has a current public use or download path.
- Published design: Greenlyz has documented an intended architecture, but the document is first-party material.
- In development or planned: scope and implementation may change before release.
No certification is implied. This site does not claim HIPAA compliance, attorney-client privilege, independent audit, or suitability for a regulated workflow.