iOS · End-to-end encrypted · In build

Calls that work on bad networks.Encryption admins cannot read.

Carillio is a messaging and calling app for iPhone. Video adapts for each person on the call instead of collapsing for everyone at once, and every message and group call is end-to-end encrypted with a published, peer-reviewed standard — not homegrown crypto.

How the encryption works
Link · one congested cellRTT 26 ms · Loss 0.0%RTT 310 ms · Loss 11%RTT 48 ms · Loss 0.4%

A nine second loop of a congested connection. The 1080p and 540p video layers switch off as packet loss rises and return as it clears. The audio layer stays on throughout.

0s36s

Several quality levels travel at once and each person receives the best they can carry, so one person on a bad cell no longer drags everyone down. Audio degrades last, and never below intelligible.

Open
Published encryption standard, not homegrown
Per person
Video quality chosen for each receiver
Audio first
Voice is the last thing to give way
Zero
Trackers, ads, analytics SDKs

01Adaptive quality

One weak connection should not ruin the call for everyone.

Group calls usually degrade together: the server tells every sender to drop bitrate because one person is on a struggling cell. Carillio does the opposite.

Per person, not lockstep
Every call carries several quality levels at once. Each person receives the highest their connection can actually carry, so a good connection stays good.
Audio is the last thing to go
Voice is protected against packet loss and stays clear when video cannot. The call gives up video long before it gives up intelligible speech.
You can see what is happening
A network HUD in the call shows why quality changed, instead of leaving you to guess whether it is you or them.
CALL · 04:12NETWORKWeak — audio priority1080540270

02Encryption

A published standard. We did not invent our own.

Carillio uses the open group-messaging encryption standard that the industry has converged on — the same direction Apple and Google took with RCS. It covers messages and group calls alike.

Your organization's admin cannot read your messages
An org admin manages membership, seats and policy. Nothing in the console — and nothing on our servers — can decrypt a conversation.
Group keys rotate on every change
Adding or removing a device moves the group to a new epoch. Someone removed at epoch 41 cannot read epoch 42.
Media is encrypted before it is uploaded
Photos, video and voice notes are encrypted on your device; object storage holds bytes we cannot open.
DESIGN TEAM · 6 DEVICESEND-TO-END ENCRYPTEDEpoch 41Rekeyed when a device joins or leavesSAFETY NUMBERMessage

03Organizations

A team workspace inside the app people already have.

No second app to install and no per-message pricing. An organization is a tenant inside Carillio, with verified identity so the people you message know it is really you.

Verified organization badges
Businesses prove a domain or a trade licence and get a badge, so a message from a company is distinguishable from a stranger with a logo.
Invite links and verified domains
Members join by link or by an email address on a domain you control. Seats are enforced by the API, not by the honour system.
Policy without surveillance
Set retention, guest access and external messaging. None of it grants anyone the ability to read a conversation.
ORGANIZATIONNorthwind LtdVerified · 24 of 30 seatsADMINInvite by linkcarillio.ravinaro.com/join/…

04How it works

What actually happens, in four steps.

  1. 01

    Verify a number

    We keep a salted hash of it, not the number itself, and your address book is matched with hashes — your contacts are never uploaded in the clear.

  2. 02

    Keys are made on the device

    Each of your devices publishes key packages and keeps its private keys in the keychain. Nothing we run has ever held one.

  3. 03

    Messages move as sealed envelopes

    Our servers queue and deliver ciphertext. Push notifications are decrypted on your phone, not on the way to it.

  4. 04

    Calls take the best path available

    Our global network forwards only the video quality your connection can carry, and finds another route when a firewall leaves no direct one.

05Pricing

Free for people. Per seat for teams.

There are no ads and there is no data business, so the only thing we sell is seats.

Personal

Freealways

Everything the app does, for everyone.

  • Unlimited encrypted messaging
  • 1:1 and group calls
  • Encrypted photos, video and voice notes
  • Multiple devices

Teams

$6per seat / month

Organizations up to 5 members are free. $60 per seat per year if you pay annually.

  • Everything in Personal
  • Verified organization badge
  • Invite links and verified domains
  • Retention and guest policy
  • Admin console and seat management
  • Cross-organization calling

Carillio is in build. Be on the first TestFlight.

One email when it reaches the App Store. We keep the address and the date, and nothing else.

Early access

Get the TestFlight invite

Carillio is not on the App Store yet. Leave an address and we will send one email when it is.

We store the address and the date, nothing else. Delete it any time by writing to privacy@ravinaro.com.