Verified, confidential calls for banks
Q-AUDION encrypts calls, video, messages and files end to end, and helps the person who answers to check who is calling and to notice a synthetic voice.
Conversations that authorise money or keep the bank running
In a bank, a conversation can authorise a payment, decide how to respond to an incident or shape a decision of the board. Three situations show what is at stake.
Confidential communications of senior management
Board members, executives and heads of treasury discuss strategy, risk and payments by voice and video. These conversations should be readable only by the people taking part.
Crisis and operational continuity
When a payment system fails or a cyber incident starts, the crisis team has to coordinate quickly, often over mobile networks and from many places. The channel must keep working and stay confidential.
Fraud with synthetic voices and executive impersonation
A cloned voice of a senior executive asking for an urgent transfer is a scenario that every employee who authorises payments must be able to recognise. Before acting, they need to know that the caller is who they claim to be.
How Q-AUDION helps
Q-AUDION runs on Android, iOS and Windows with the same protocols on every client, and the server can be installed on your own infrastructure.
Calls and video encrypted end to end
Each call starts with a new key agreed with ML-KEM-1024 (NIST FIPS 203) and X25519, renewed during the call at most every five minutes. Voice and video are protected with AES-256-GCM, and the server routes only ciphertext.
An alert if the voice is synthetic
A model that runs on the phone (adaptive AASIST) analyses the other party's voice in real time and warns the user during the call, without interrupting it. The audio is not sent to the server for this analysis.
Contacts whose identity you can verify
Contacts are verified by NFC pairing (Ed25519 signature and a six-digit code bound to the exchange, confirmed by both sides), by proximity QR or by a 60-digit safety number.
Messages and files with the same protection
Messages between two contacts use a post-quantum ratchet (ML-KEM-768 + X25519) with forward secrecy for each message and post-compromise security. Attachments and files are encrypted end to end.
Group calls and difficult networks
Group calls are end-to-end encrypted on a media server that forwards only ciphertext, with the group key renewed every 30 minutes and at every change of participants. If the network blocks the direct path, the connection falls back automatically to TURN, WebSocket or MASQUE.
Console, remote wipe and audit log
Administrators invite users, block accounts, revoke devices and wipe a device remotely with a signed command. Access is protected with TOTP and passkeys, administrators can be limited to their own scope, and the server keeps a hash-chained audit log.
Designed to support customers' compliance with DORA and NIS2
DORA (Regulation (EU) 2022/2554) governs ICT risk management for financial entities, including the risk that comes from ICT third-party providers. NIS2 (Directive (EU) 2022/2555) requires cybersecurity risk-management measures from the entities in its scope. Q-AUDION is designed to support your compliance with both for the communications it carries.
Among the cybersecurity risk-management measures, Directive (EU) 2022/2555 lists, where appropriate, the use of secured voice, video and text communications and secured emergency communication systems within the entity.
Directive (EU) 2022/2555 (NIS2), Article 21(2)(j)
Data and infrastructure in the EU
Production nodes are in Italy and Finland, and no third-party TURN or media service is used. GDPR functions include signed export of account data, account deletion, phone numbers stored only as hashes and configurable retention.
Three ways to install Q-AUDION, under your control
Choose where the service runs and who operates it. Functions and protocols are the same in all three.
Dedicated EU cloud, managed by BCrypto
Operated by: BCrypto
A dedicated instance in a European Union cloud, installed and operated by BCrypto. No infrastructure for you to maintain.
Dedicated server in your data centre, managed by BCrypto
Operated by: BCrypto
A virtual or physical server in the customer's data centre, with keys, domain and apps dedicated to your organisation, operated by BCrypto.
Installed at your premises, self-managed
Operated by: The customer
Installation on your own infrastructure and independent management, with training and support from BCrypto.
Customer-held KMS: if the server is installed at the customer's site, the root key stays in the customer's infrastructure.
Services
Installation and configuration
Setting up and configuring the service for your organisation.
Operations
Updates and maintenance of the service in the models managed by BCrypto.
Training
Courses for console administrators and for app users.
Support
Technical assistance from the BCrypto team in all three models.
Try Q-AUDION in your organisation
We will send you an invitation to try Q-AUDION. For your CISO and compliance team we can also arrange a confidential technical briefing on architecture, installation models and documentation.
A summary for banks, insurers and energy companies: security, deployment models and services.
Get the Enterprise BriefCompliance documentation (DPA, DORA addendum, supplier data sheet, exit plan, SBOM and vulnerability disclosure policy) is available on request through our contact form. Request the documentation