Contact

Ask us something, and see first what we keep.

Two things bring people here: an Enterprise quote, which is the one plan with no listed price, and a voucher, which is how you pay for Haven without a card. Anything else is welcome in the same box.

Before you type: this form stores what you write and nothing else. No IP address, no browser string, no referrer, no cookie, no identifier of any kind — the server's own routes/sales.js says so and the row it writes has nowhere to put one. A newsroom or a legal team should be able to ask about an encrypted messenger without the asking becoming a record that they were considering it. What we do keep is below the form, in full.

The form

Tell us how to reach you, and what about

There is no autoresponder and there cannot be one: this server has no mail path at all — no SMTP client, no provider, no queue — so nothing here can send you anything. Your enquiry lands on an operator's console and a person answers it by whatever route you gave us. You will not get an automatic acknowledgement, and its absence does not mean the message went missing.

Every bound below is the server's own, not a guess: 200 characters of contact, 2,000 of message, seats a whole number from 1 to 100,000.

How to reach you

Whatever route suits you: an email address, a Signal number, a Haven username on this instance, a postal address. We do not parse it, validate it into an address shape, or hand it to anything — it is a string a person reads. Nothing is sent to it automatically.

What is this about Enterprise — a quote, a dedicated instance, a contract Something else — a voucher, a question, a security report A complaint about how we handle your personal data — acknowledged at once, with a reference, and answered within a month

Seats, if you know

Optional, and only useful on an Enterprise enquiry. Enterprise bills from 50 seats.

Message

Assume an operator reads this and nobody else, and assume it is stored in the clear — this form is not end-to-end encrypted and does not pretend to be. If what you have to say needs encrypting, say so here in a sentence that does not, and we will move the conversation into the app.

This works with scripting off. The form posts itself and brings you back to this page, where the answer appears just below this line. Nothing you typed comes back in the address. With scripting on, the one script this site loads sends it without leaving the page and writes the answer in the same place.

Sent. A person reads these — there is no autoresponder and there cannot be one, so silence for a day is silence and not a lost message.

Your complaint was received and recorded with a reference, and we will respond within a month. With scripting off this page cannot print the reference itself: it is the code beginning DP- in the address of this page, after ref=, followed by the date received and the date a response is due. Copy it before you leave. You can complain to the Information Commissioner's Office at any time.

That was not sent: the server could not accept what was in the form. The usual cause is an empty "How to reach you" box, or a seat count that is not a whole number. Nothing was recorded; correct it and send again.

That was not sent: too many enquiries have come from your address in a short time. Wait a few minutes and send it again. Nothing was recorded.

That was not sent: the enquiry queue is over capacity at the moment. Nothing was recorded. The section below has other ways to reach us.

That was not sent, and the server did not say why. Nothing is known to have been recorded; the section below has the request to make by hand.

You have scripting off, which is the right setting for this audience

The form above still works. It posts itself the ordinary way and returns you to this page, which shows the answer under the button; nothing you typed is echoed back into the URL, because a query string is the part of a page that ends up in a proxy log and a browser history. If you would rather not submit a form at all, the request is written out below in both encodings, so you can send it by hand from a terminal.

With JavaScript off

Two ways to reach us that need no script at all

Send the request yourself

The endpoint is public, unauthenticated and takes one JSON object. Against the instance you would be using, that is a POST to /api/sales/enquiry with Content-Type: application/json and a body of {"contact": "…", "seats": 50, "message": "…", "source": "enterprise"} — seats optional, source either enterprise or contact. A successful send answers 201 and {"ok": true}, and deliberately returns nothing else: no id, no queue position, nothing that would let a stranger count how much business we are getting.

The same route also accepts Content-Type: application/x-www-form-urlencoded — that is what the form on this page uses when you have scripting off — so contact=…&seats=50&message=…&source=enterprise&redirect=/contact.html works just as well. The two differ in one place, deliberately: a form body has no types, so on that path seats arrives as characters and is converted, while the JSON path still refuses "50" as a string. redirect is honoured only for a form body, and only to a path on this site — an open redirect on an unauthenticated public endpoint is a phishing link with our hostname on it.

The limit is five an hour from one address, which is the tightest rate limit anywhere in this server, and the body is capped at 16 KB above which you get a 413. If you are coming through Tor you are sharing that address with other exit users, so a refusal there is not about you.

Use the address in security.txt

/.well-known/security.txt carries the contact route the operator of this instance publishes, in the format RFC 9116 defines, and it is the right one for a vulnerability report in particular — a security finding should not be sitting in a sales queue. Read the note at the top of that file before you trust the address in it: as this repository ships, that line is a value the operator has to set, and the file says so rather than pretending otherwise.

What this form keeps

The whole row, named

What you typed in How to reach you, truncated at 200 characters.
Your message, truncated at 2,000 characters.
The seat count, if you gave one.
Which of the two boxes you ticked — enterprise or contact — so an operator can sort a queue by it.
The time it arrived, to the second.
Whether somebody has dealt with it yet, and which member of staff did.

And the things it does not keep, which is the shorter list to check

No IP address, no User-Agent, no referrer, no fingerprint, no cookie. The rate limiter sees the address your request arrived from — it has to, that is what a rate limiter is — and forgets it when the hour closes; nothing about the sender reaches the table. There is no account link either, because the form takes no sign-in.

Three characters classes are stripped from what you send before it is stored: control bytes, ANSI escape introducers, and the Unicode bidirectional overrides. Not to censor anything — they are removed because their only purpose in a hostile message is to make stored text display in an order it is not stored in, on a terminal or in the console an operator reads it on. Ordinary text, in any language, passes through untouched.

Where it goes, and how long it stays

Into sales_enquiries on the same database that runs the instance, read through the operator console by a member of staff, whose reading of it is recorded in an append-only audit log. The account-facing disclosure panel lists that table by name and says exactly this about it, which is the copy you can check against your own database rather than against this page.

There is a hard ceiling of 2,000 unhandled enquiries on the whole instance. Past it the form refuses with a sentence telling you so, rather than accepting your message and dropping it — because an endpoint that silently discards is worse than one that says no. Nothing sweeps this table on a timer; an enquiry stays until an operator clears it.

Enterprise

What is actually quoted, and what is not negotiable

Enterprise is the one plan in the catalogue marked custom, which is why it has no price on the pricing page and a conversation instead of a button. It bills from 50 seats with no ceiling above that.

What a quote can move

The price, the seat count, the billing arrangement and the payment method — including invoicing and vouchers rather than a card. A dedicated instance. Written terms on what the server holds, which for us means writing down the same list this site publishes and signing it. A support commitment with a number in it and a remedy attached, which the listed plans deliberately do not have — the service level page says what they do have instead.

What no amount of money moves

The cryptography, which is the same code at every tier including the free one. The metadata: conversation membership stays an indexed plaintext table and timestamps stay at one-second resolution on a dedicated instance exactly as they do on a shared one. The absence of an audit. And the fact that the JavaScript doing your encryption is served by the machine you would be hiding from — a dedicated instance changes who operates that machine, not whether it has to be trusted. The threat model is the page to read before the quote.

Schools, charities and councils

Buying Haven without a framework

Haven is not on a public-sector framework, and most purchases of it are small enough that your own organisation's rules decide how you buy — a quote, or three, rather than a tender. This is what you can have from us for that, without asking anybody's permission.

A written quote for the plan, the seats and the period, on request through the form above. Choose "Enterprise — a quote" and say what your finance team needs on it.
The data processing agreement, already published and the same for everybody: dpa.html.
The list of every third party that touches the service, and what each receives: subprocessors.html.
What the server holds about each person, counted from the live schema: privacy.html. And what it does not protect against: threat-model.html.
Paying without a card: prepaid vouchers, bought once and handed out, which suit a budget that is spent in one go. See how paying works.

What we cannot give you: a framework listing, a certification (there is none — see security), or advice on your own procurement rules, which your finance lead knows better than we do.