Tactical Profile

For environments where the network is a variable, not a given.

The Tactical Profile is an operational and security profile of the Tunnel platform. It governs how Tunnel Mobile, Tunnel Command and Tunnel Relay behave when connectivity is intermittent, contested or absent, and when operational identity must not become a permanent relationship record. It is a profile of the platform, not a separate product and not a second mobile application.

  • Disconnected operation
  • Mission-scoped authority
  • Native only
  • Customer-controlled trust

One platform

The same components, operating under different assumptions.

Nothing in the Tactical Profile is a parallel system. The clients, the authority model and the bundle format are the platform's own, placed under a profile that assumes the environment is hostile to the assumptions ordinary software makes.

01

Tunnel Mobile

Native mobile endpoints, operating with content sealed on the device and composed whether or not a link exists.
Explore Tunnel Mobile02

Tunnel Command

Native desktop administration: missions, compartments, enrollment, authority issuance and revocation, under the customer's control.
Explore Tunnel Command03

Tunnel Relay

Customer-operated custody infrastructure carrying sealed bundles across links that appear and disappear.
Explore Tunnel Relay

Secure Mission Bundles

Communication as a package, not a session.

A session assumes both parties are present. A package does not. Under the Tactical Profile every communication is a Secure Mission Bundle that carries its own authorization, policy and expiration, and can be delivered whenever a permitted transport appears.

Store-carry-forward

Offline operation as the normal case.

Bundles are composed offline, held on the device, handed to relay custody when a link appears, and collected on the next contact window. A bundle past its validity window is refused rather than delivered late.

Delivery across an intermittent linkA sender composes and seals a bundle while disconnected. The bundle waits on the device. When any permitted transport becomes available it is handed to the relay, which holds it in encrypted custody. The recipient collects it on the next contact window. If the validity window closes first, the bundle expires rather than being delivered late.1Composed offlinesealed on device2Held on deviceawaiting any transport3Relay custodyencrypted, opaque4Collectednext contact windowDASHED: LINK AVAILABLE ONLY INTERMITTENTLYContent is encrypted before it reaches relay custody and stays sealed for the whole journey.A bundle collected after its validity window has closed is refused rather than opened.
Delivery is resumable and does not require sender and recipient to be connected at the same time. Carriage windows and radio-layer performance depend on the transport and its integration partner.

Mission-scoped authority

Authority, scoped to one mission.

Authority can be constrained by mission context, relationship, capability, device and time. Authority to communicate is directional, capability-scoped and time-limited. It stays inside the mission that issued it, and it expires on its own rather than settling into a permanent contact.

Mission-scoped grants
Authority is issued inside a mission and is bounded by it. Two missions on one device do not share the authority granted in either.
Mission compartments
Compartments bound who may communicate within a mission. They are an authorization structure issued by the customer's authority, not a renamed group chat.
Directional communication authority
Authority is issued per edge and per direction. Authority to reach a counterpart does not create authority for that counterpart to reply; a reply requires separately issued authority.
Expiring authorization
Authority carries a signed validity window and ends on its own, so permission is not something the organization must remember to remove.
Contact-graph minimization
Each device learns its own edges rather than the mission topology, so a captured device does not disclose the shape of the mission.

Authorization to communicate with someone in one operational context does not automatically create an independent or permanent relationship with that person.

Provisioning and device trust

Bringing a device into a mission, and taking it out again.

Enrollment happens under the customer's authority. Trust is bound to the device. A device that is lost is a device that can be withdrawn without disturbing anything else.

QR-controlled provisioning

Devices are provisioned through a controlled, in-person exchange rather than an emailed link, so the act of enrolling is itself an authorized event.

Device-bound trust where supported

Credentials are bound to the specific device. A credential copied onto another device does not function there.

Independent device revocation

Each device is revoked on its own. An operator who loses one device keeps standing on the others.

Customer-controlled trust

The root of trust that makes all of this meaningful is held by the customer in a sovereign deployment.

Boundaries

Native only. Deliberately.

The Tactical Profile runs on native clients because a browser cannot hold the properties the profile depends on. This is not a gap to be filled later. It is the boundary.

  • Native mobile endpoint
  • Native desktop Tunnel Command
  • No browser Tactical client
  • No browser Tactical administration
  • No browser credential storage
  • No cookie-based Tactical authentication
  • No browser fallback

Transport and partners

Tunnel is the application layer.

The Tactical Profile is designed to carry bundles over approved transports and customer-operated relay infrastructure. The links themselves come from partners.

TRANSPORT

Internet

Encrypted carriage over IP.

Carried today

TRANSPORT

Private IP

The same carriage over a customer-controlled network.

Carried today

TRANSPORT

SATCOM

Constrained, intermittent, high-latency carriage.

Partner integration, not delivered

TRANSPORT

Tactical radio

Narrowband carriage supplied by qualified radio hardware.

Partner integration, not delivered

TRANSPORT

Local device link

Short-range exchange between two devices.

Partner integration, not delivered

TRANSPORT

Physical carry

Store-carry-forward of a sealed bundle with no link at all.

Verified in the reference engine

TRANSPORT

Air-gapped environment

Controlled transfer into and out of a disconnected domain.

Deployment-specific integration and acceptance

Bundles are carried over IP today. Satellite, tactical radio and short-range links are modeled against the bundle format and the relay queue, for latency, bandwidth, MTU, frame loss and availability windows, so that behavior under a constrained link is measured before hardware arrives. A modeled link is not an integrated one, and field integration is a partner engagement that has not been delivered.

Tunnel governs communication above the transport layer. Radio performance, waveform protection, anti-jamming and low-probability-of-intercept properties remain the responsibility of the qualified transport system.

Radio-layer performance and protection depend on qualified communications hardware and integration partners. Tunnel makes no waveform-layer claim.

  • Approved transport integration is scoped per deployment and per partner.
  • Relay infrastructure under the Tactical Profile is customer-operated.
  • Hardened-device integration is a partner boundary with a defined interface.
  • Tunnel holds no government authorization and represents no approval for classified information.

Notice

Product configurations, integrations and operational capabilities are delivered according to customer requirements, deployment environment, validation scope and applicable authorization. No approval for classified information is represented.

Controlled evaluation

Prove the profile under your own operating conditions.

Organizations assess this profile against their own operational conditions: their links, their compartments, their device handling and their loss scenarios. Tunnel runs controlled evaluations built around those questions.

Request a Controlled EvaluationRequest an Executive Security Briefing