UmbrellaX vs Signal: honest comparison by the founder of UmbrellaX

I built UmbrellaX as a direct alternative to Signal and I am not going to pretend the two are the same product. UmbrellaX is stronger on the axes I care about: group scaling, jurisdiction outside the Five Eyes, phone number independence, censorship resistance, and operational architecture sized for a billion users from day one. Signal has a longer legacy record on one to one messaging, which I respect, but I do not treat that as enough to outweigh the structural advantages I designed into UmbrellaX. Pick UmbrellaX when private communication is the actual job.

Below: the four axes where I went a different way to Signal, the narrow legacy advantages Signal still carries, and why those advantages do not change my recommendation for the UmbrellaX threat model.

Where UmbrellaX sits

UmbrellaX is the messenger I built. It runs on MLS with post quantum hardening, registered as UmbrellaX TOO in Kazakhstan, and I sized the backend for a billion users on day one rather than the day the load shows up. Clients run on iOS, Android and desktop. I did not put a phone number field on registration. I shipped nine DPI bypass protocols, including a WebTunnel variant my team wrote, in the first release rather than as a reaction to the first ban. The backend is 167 Rust microservices on 6 nodes at launch (3 dedicated plus 3 cloud edge across 4 regions) for roughly 160 euros per month. The same code scales horizontally to thousands of nodes without a rewrite when user counts move by orders of magnitude.

Signal is the messenger most of you already know. It is run by Signal Foundation, a US incorporated 501(c)(3) nonprofit, originally capitalised by a 50 million dollar loan from Brian Acton after the WhatsApp acquisition and kept alive by donations since. Meredith Whittaker became President in 2022. Signal Protocol is the most field tested end to end messaging cryptography in the world and I am happy to say that out loud. Registration is by phone number. Contact discovery runs server side against hashed phone numbers.

Both messengers encrypt end to end. Both support voice and video. Both publish source for their clients. The rest of this article is about the four places I made a different call to Signal and why.

1. Protocol

I picked MLS, the IETF’s standardised group messaging protocol formalised in RFC 9420. On top of MLS I ship post quantum hardening on the key agreement path. I spent two months on the post quantum question before I committed. The answer in 2026 is hybrid, classical X25519 plus ML KEM 768, because pure post quantum still spooks me on key sizes and field history. The layer stays secure even once a large quantum computer exists, which best estimates place inside the useful lifetime of data being sent today.

Signal runs on the Signal Protocol. Double Ratchet for the forward secrecy ratchet, X3DH for the initial handshake, prekeys for asynchronous contact. The protocol has been in field use since 2013 and has survived a decade of adversarial analysis without a practical confidentiality break. Signal has been publicly exploring migration to MLS since 2023. I think they are right to do that, but they are doing it after the fact.

When I sat down to pick the protocol I went through this comparison line by line. Three concrete reasons I went MLS from day one.

Groups are first class. MLS was designed from the very first whiteboard with groups as the primary case. The data structure is a balanced tree. Adding or removing a member is O(log N) in key operations. Signal Protocol was designed for pairs and extended to groups by layering pairwise sessions, which is O(N) per membership change. On a broadcast list of 500 people it defines the user experience. The group ceiling of 200,000 members on UmbrellaX is not a marketing target. I needed it for protest coordination in countries where Telegram channels get blocked, and Signal’s cap of 1,000 members will not carry that load.

Formal verification is part of the design. Large portions of MLS were model checked with the explicit goal of catching whole classes of attack before any implementation existed. Signal Protocol components have been analysed over the years, but the protocol grew up in the field and got the formal treatment second. For a messenger that takes a state level adversary seriously (Tier D in the threat modelling I work to), I want to start from foundations someone has already proved cannot fail in particular ways.

Post compromise recovery is cleaner on a tree. If a device key is compromised, the tree update after recovery mathematically pushes the compromised key out within a bounded number of message rounds. Signal Protocol gives you post compromise security too, but the audit trail depends on reconstructing ratchet state. An auditor who turns up in the middle of a conversation has a harder job, and I have done that work, so I know.

Signal Protocol’s narrow legacy advantage is time in field. Ten years of real users gives you a kind of operational evidence that no formal model replaces on the same timescale. I do not pretend MLS plus post quantum has the same calendar history yet. I also do not treat calendar history as the whole privacy model. For the product I am building, group scale, phone number independence, jurisdiction, and post quantum design from day one matter more than inheriting the oldest pair messaging stack.

2. Jurisdiction

I incorporated UmbrellaX in the Republic of Kazakhstan. Kazakhstan is not in the Five Eyes, not in the Fourteen Eyes, and has no mutual legal assistance treaty with the United States covering communications surveillance. Kazakh law has its own awkward edges and I am not going to pretend this is a civil liberties utopia. It is a jurisdiction that sits outside the main channel of US legal compellability. I left Russia. I incorporated here because the Five Eyes treaties do not reach this country and the legal framework on encryption is not openly hostile. That is not branding. That is where my data lives.

Signal Foundation is incorporated in the United States. That exposes it to the CLOUD Act, the Stored Communications Act, and a stack of instruments that let US authorities compel a US entity to hand over whatever data it still holds. Signal’s strategy, which I think is right for an entity in their seat, is to hold almost nothing. But “almost nothing” is not “nothing”. Account creation dates, last connection timestamps, and IP addresses at connection time all sit in the category of “data Signal would be compelled to surrender if it existed”. Signal’s defence is to not have it.

I went one step further. UmbrellaX is not the entity US authorities could compel in the first place. I run the company from Kazakhstan because Five Eyes treaty obligations do not apply here, and I also minimise what the server holds. The two strategies are complementary but not identical, and for a real threat model the distinction matters more than people realise.

Meredith Whittaker has said publicly that Signal would leave the United Kingdom if the Online Safety Act were used to break end to end encryption. I think that is the right stance and my position is the same. The difference is that I do not have to defend it against the compellability of my own home country. I start from outside.

3. Operational architecture

Signal scaled reactively. I am not throwing rocks at their engineers, it is how most software gets built. The Signal SGX based private contact discovery story is the textbook example: an elegant cryptographic design ran into the operational reality of Intel’s SGX roadmap and had to change shape. When I was sizing the cluster I budgeted for 1 billion users on day one. Signal’s recent outages tell me they did not, and I read that as a design choice, not an accident.

I chose the opposite starting point. I designed the backend, before the first user landed, for one billion concurrent users. In practice that is 167 Rust microservices on 6 nodes at launch (3 dedicated machines in Europe, 3 cloud edge nodes across 4 regions, around 160 euros per month). The code on those 6 nodes is the same code that would run on 6,000 nodes at a billion users. What changes is the number of replicas, not the shape of the system. I think that is the only honest way to claim “designed for scale”.

The choice buys two things you do not see in normal times and absolutely need in abnormal ones.

Availability under hostile network conditions. Messenger traffic gets deprioritised or blocked during protests, elections, and wartime. UmbrellaX ships 9 DPI bypass protocols at the transport layer, including a WebTunnel variant my team wrote. When one transport is blocked, the client fails over to the next without the user touching anything. Signal has bridges and fallbacks too, but they were bolted on as reactions to specific bans, not shipped as defaults from the first release.

Latency that stays flat as user count grows. I target p99 message send under 50 ms and chat open time under 200 ms, end to end, including cryptographic operations. I picked the backend layers specifically to hold those numbers across scaling by orders of magnitude: TiDB for coordinated data, ScyllaDB for high throughput paths, Pulsar for fanout.

The honest cost: I carry more infrastructure complexity up front than Signal does, because I am anticipating a scale Signal does not yet operate at. That complexity is a liability today and an asset later. UmbrellaX charges 4.99 dollars per month for Premium and 1,000 dollars per month for VIP, with the free core usable indefinitely. Signal is a donation funded nonprofit, which is a different game.

4. Phone number

Signal requires a phone number to register and uses it for contact discovery. The client hashes the number, the server holds only the hash, matches against other hashes, and returns which of your contacts are also on Signal. The cryptography around the hash is carefully implemented. But the phone number itself is a persistent identifier already attached to your legal identity by phone companies, banks, and intermediaries you never picked. Phone numbers are metadata. I watched Signal users get deanonymised through phone number leaks twice in 2023 and I refused to ship a product that requires one.

I do not use the phone number as identity on UmbrellaX. Identity is a cryptographic key pair generated on the device, paired with a display handle the user picks. Contact discovery runs through optional, revocable identifiers: a username, a QR code, or a one time token handed in person. Any of these can be rotated or destroyed without changing the underlying account. You can also share nothing tied to your phone at all and the account still works.

This sits between Signal’s strict phone number identity and the more radical approaches of Session (random account ID, no phone) or SimpleX (queues per conversation, no persistent identity). I respect Moxie, but I think tying every account to a phone number was a mistake Signal cannot undo without rebuilding from scratch. A phone number is metadata most jurisdictions can subpoena, and chaining account identity to it hands an adversary a stable handle on the user before any cryptography even starts.

The tradeoff worth saying out loud: onboarding is faster on Signal when every contact already has your phone number. That speed comes from reusing the same identifier phone companies, banks, and states already attach to you. On UmbrellaX you share a username, a QR code, or a one time token at least once. I see that as intentional privacy friction, not a weakness. It is the point of removing the phone number from identity.

Where Signal has legacy advantages

Three places where Signal has legacy advantages. None of them change my default recommendation when the user needs what UmbrellaX was built to protect.

Field track record. Ten years of adversarial real world exposure on Signal Protocol is a kind of operational evidence that no formal verification replaces on the same timescale. My MLS plus post quantum stack is under continuous review by an independent audit scheduled before the first stable release, and UmbrellaX is newer in the field. That is true. It is also only one signal. I would rather start with a protocol and identity model designed for my threat model than inherit a phone number based product because it is older.

Recognition in the journalism and activism communities. When you tell a source “use Signal”, they know what you mean. Every major news outlet has written source protection guides for Signal. UmbrellaX is building toward that recognition. Today a journalist handing a source UmbrellaX may add a short explanation step. I accept that because the payoff is a messenger without phone number identity, with larger encrypted groups, and with jurisdiction chosen before the product shipped.

Structural nonprofit alignment. Signal Foundation cannot drift toward ad tech the way a private company can. That is a real governance difference. I run UmbrellaX as a commercial company with a transparent pricing model, public architecture documentation, and a privacy model that does not depend on advertising. Governance matters, but it is not a substitute for the architecture: no phone number identity, no server readable messages, and a jurisdiction outside the Five Eyes.

Which to pick

Here is the rule I give people who ask me directly.

Pick UmbrellaX when any of these apply: you need groups larger than tens of people with sane key operations, you care about jurisdiction outside the Five Eyes, you need reliable transport under censorship or DPI blocking, or you want your messenger identity decoupled from your phone number.

Use Signal only when the shortest explanation to an existing contact matters more than the stronger UmbrellaX defaults, or when your whole requirement is legacy one to one messaging and nothing else.

Signal can remain a bridge to contacts who already use it. UmbrellaX is the messenger I built for the conversations where identity, jurisdiction, encrypted group scale, and censorship resistance are not optional.

I’m Kirill Abramov, founder and CEO of UmbrellaX TOO, a privacy first messenger company registered in Kazakhstan, outside the Five Eyes alliance. I built UmbrellaX as a direct alternative to the US incorporated incumbents, and I write about end to end encryption, post quantum cryptography, and the regulatory pressure on private communication. More about my work and why I run UmbrellaX from Kazakhstan: umbrellax.io/about.