An independent, end-to-end encrypted channel for IT paging, emergency broadcast and secure chat. It is archived to your firm's system of record and runs on none of the infrastructure that just failed. It is also the channel your response team can use if your network is compromised.
Designed for RIAs, broker-dealers and funds of 20 to 200 people.
Staff fall back to personal texts and consumer chat apps. Nothing is archived, and nobody can say who was told what.
When the data center, key servers or network have problems, IT has no paging system outside the infrastructure that is failing.
Trade confirmations and settlement questions move to whatever channel still works, usually with no record and no verified contact list.
During ransomware or a mailbox takeover, an attacker may be reading your email and chat. BCP Bridge sits outside your network and your Microsoft tenant, so your response team can coordinate without tipping them off.
One encrypted room for the IT response team, with Legal, Compliance, Investor Relations and outside counsel brought in as the incident needs them. Created in one tap and reachable from personal phones.
The incident response plan, call trees and counsel and insurer contacts sit in the vault on each phone, with no network needed.
IT leads the room. Legal and Compliance join to decide on notices and regulator contact, Investor Relations prepares investor messaging, and outside counsel and forensics join as guests with limited access. A guest sees only the rooms they are added to, and Legal can make a room privileged.
Broadcast to the whole firm, or page just the response team, with check-ins so you know who is reachable.
Confirm wire and payment requests by an out-of-band call or message to a known contact, since email may be spoofed.
Remote wipe, revoke a person's keys and remove them from rooms when a device or account may be compromised.
Messages are archived to your firm's system of record, and a tamper-evident log shows who did what and when.
BCP Bridge supports your response and does not detect or stop attacks. Chat is end-to-end encrypted. Alerts and SMS are not.
Monitoring tools, appliances and applications send alerts through a simple API. On-call schedules and escalation reach the right person by push, then SMS, then voice.
One message goes out by push and SMS. Staff reply with a tap, and managers see who has checked in. This is the same list you use in your business continuity plan.
Messages are encrypted from device to device. Your firm holds a key that delivers a copy to your existing archive, such as Global Relay or Smarsh, so employees never need to use unapproved channels.
Sample screens with invented data from the concept prototype. Example Capital is a fictional firm.
See who is safe and who has not answered, then follow up with the people who need it.
If an attacker may be reading your mail, the response team talks somewhere else, and the record is kept.
Staff stop guessing which systems are up, and IT stops answering the same question by phone.
Plans, call trees and drill sign-offs are stored on the device, so they open even when the network does not.
Both sides approve the connection, so you know who is on the other end of a trade confirmation or a wire callback.
Rotations and backups for each team, so an alert at 3 a.m. reaches a person and not a shared inbox.
Checks run from outside your network every minute. When several in a row fail, IT is paged and can declare an outage with one tap.
New staff get the right groups and contacts on day one. When someone leaves, one action ends their access, wipes their device and hands off their duties, while their records stay in the archive.
Each firm sets up its own space. Put your name and colors on it, choose which functions to turn on, and decide which departments get them.
| Function | Trading | Operations | Compliance | Legal | IT |
|---|---|---|---|---|---|
| IT paging | Off | Off | Off | Off | On |
| Emergency broadcast | On | On | On | On | On |
| Secure chat | On | On | On | On | Off |
| Contact directory | On | On | On | On | On |
| BCP vault | Off | On | On | On | On |
| Trusted network | On | On | Off | Off | Off |
An independent system only earns trust if you can control it and walk away from it.
Your firm owns its messages, contacts and settings. We do not use them for anything else, and your records live in the archive you already pay for.
Choose how long messages and files are kept, by department if you need to. Legal holds override deletion until Legal releases them.
Export everything in an open format whenever you like: contacts, settings, activity logs and archived messages. When you leave, your data is deleted and we confirm it in writing.
These are design commitments for the pilot. The exact terms will be set out in the customer agreement.
A web management site gives Compliance, Legal and IT each their own controls. Sensitive changes need a second person, and every action is logged.
Changes to archive destinations, encryption keys or mass device wipes require approval from a second administrator, in a different role.
Built to be a separate failure domain from your email and identity provider, and to satisfy your compliance officer from the first day.
Chat uses the MLS standard (RFC 9420). The service operator cannot read your messages.
Decrypted only inside your firm's own controlled archive member, then delivered to Global Relay, Smarsh or another commercial archiving service.
No Entra, Exchange or Intune in the path. Sign in with passkeys, with optional SSO and a cached copy for outages.
Remote wipe, plus an automatic offline lock if a device stays disconnected too long, for example during travel.
Runs outside your MDR and XDR tooling, so an incident in one does not silence the other.
Managed on a web console with groups and entitlements. Staff carry the critical counterparty list in the app, even when travelling.
Passkeys replace passwords, so there is nothing to phish. Sessions time out and can be ended remotely.
Each phone proves it is a genuine, unmodified device. Rooted or jailbroken phones are blocked.
Encryption keys sit in the firm's own key vault. Revoke them and the data cannot be read.
Every administrator action is written to a log that cannot be edited, readable by Compliance.
New devices, impossible travel and repeated failed sign-ins alert your security team.
A web application firewall and denial-of-service protection sit in front of the service, and the app checks it is talking to the real service.
We are not yet certified. These are the independent checks on our plan. We will share results with pilot firms as they are completed.
Alert pushes, broadcast and SMS fallback are not end-to-end encrypted by design, because they must reach people on any device. Preview only. Security claims describe the planned design and are not yet independently tested.
Verified contacts at other firms, like a dealer ring-down.
Confirm or dispute messages with a record on both sides.
A trusted off-channel room for the response team and a system status board.
Keep investors informed during a major event.
Plans on every phone, plus drills and attestations.
Out-of-band checks before money moves.
We are working with a small group of financial firms on a no-fee pilot. If an independent, archived channel for outages sounds useful, email us and we will set up a conversation.