Managed Matrix · WebRTC

Chat and calls under your domain. Not your on-call rotation.

Voxweave hosts Synapse, LiveKit and coturn for teams that want encrypted messaging and group calls without operating the stack themselves. You bring a domain and an identity provider; we keep the media flowing.

Start 14-day trial Read the docs

EU data residency
E2EE by default
99.95% SLA
No client lock-in

deploy — bash

$ voxweave deploy --domain chat.acme.eu
✓ homeserver   chat.acme.eu        synapse 1.121
✓ calls        rtc.acme.eu         livekit 1.9.1
✓ turn         turn.acme.eu        coturn 4.6.2
✓ tls          Let's Encrypt       auto-renew
✓ backup       restic → eu-central 02:00 UTC
→ live in 94s  https://chat.acme.eu

1.2Mmessages per day

38 msmedian call setup

99.98%90-day uptime

2EU regions, your choice

Everything a chat stack needs, none of the pager duty.

One tenant, one bill, one place to look when a call drops. We run the pieces; you keep the domain and the data.

Matrix homeserver

Synapse on Postgres, patched weekly, with federation, media retention and .well-known delegation handled for you.

Group calls

Native Matrix calls through LiveKit: rooms, screen share and recording. Media stays end-to-end encrypted; the SFU only forwards frames.

TURN that survives NAT

coturn with short-lived credentials, TCP/443 fallback and per-tenant quotas, so restrictive networks still get a relay path.

Bridges

Telegram, WhatsApp, Slack and IRC bridges run as isolated appservices, with per-bridge rate limits and a kill switch.

SSO and provisioning

OIDC or SAML, SCIM user sync, session revocation and audit-log export to your SIEM. No separate directory to keep in sync.

EU residency

Frankfurt or Helsinki, encrypted daily backups, configurable retention and a signed DPA before your first message is stored.

Boring on purpose.

Standard Matrix and WebRTC components, wired the way the specs expect. Any Matrix client works; nothing proprietary sits in the path.

Per-tenant topology. Caddy terminates TLS; Synapse, LiveKit and coturn run as separate systemd units with their own resource limits.

Drop-in configs, not a migration project.

Point your domain at us and keep using Element, FluffyChat or any other Matrix client. These are the actual shapes of the files we manage.

Well-known /.well-known/matrix/client

{
  "m.homeserver": {
    "base_url": "https://matrix.acme.eu"
  },
  "org.matrix.msc4143.rtc_foci": [
    {
      "type": "livekit",
      "livekit_service_url": "https://rtc.acme.eu"
    }
  ]
}

Compose docker-compose.yml

services:
  synapse:
    image: ghcr.io/element-hq/synapse:latest
    volumes: ["./synapse:/data"]
    environment:
      SYNAPSE_SERVER_NAME: matrix.acme.eu
      SYNAPSE_REPORT_STATS: "no"

  livekit:
    image: livekit/livekit-server:latest
    network_mode: host
    command: --config /etc/livekit.yaml

  coturn:
    image: coturn/coturn:latest
    network_mode: host
    command: -c /etc/coturn/turnserver.conf

LiveKit livekit.yaml

port: 7880
rtc:
  tcp_port: 7881
  udp_port: 7882
  use_external_ip: true
turn:
  enabled: true
  domain: turn.acme.eu
  tls_port: 5349
  udp_port: 3478
keys:
  livekit: ${LIVEKIT_SECRET}

TURN turnserver.conf

realm=turn.acme.eu
use-auth-secret
static-auth-secret=${TURN_SECRET}
fingerprint
lt-cred-mech
min-port=49160
max-port=49200
no-multicast-peers
no-cli

Priced per tenant, not per seat.

Every plan includes TLS, backups, monitoring and the full call stack. Upgrade when the user count does, not when a feature is paywalled.

Starter

€49 / month

For a single team getting off a shared workspace.

Up to 50 users
1 homeserver, 10 GB media
Group calls up to 25
Daily encrypted backups
Community support

Start trial

Team

€149 / month

For organisations that need SSO and bridges.

Up to 250 users
SSO (OIDC / SAML), SCIM
3 bridges, 100 GB media
99.95% SLA, email support
Audit-log export

Start trial

Enterprise

Custom

For regulated teams and large federations.

Unlimited users
Dedicated Synapse and SFU
Region and retention choice
DPA, pen-test report, 24/7
Migration engineer included

Talk to us

Prices exclude VAT. Annual billing saves 20%. Migration from your current homeserver is included in every plan.

Encrypted where it matters, observable where it doesn't.

We can see that a call happened and how long it lasted. We cannot see what was said, and neither can the SFU.

TLS 1.3 only; HSTS preload; no downgrade paths
Olm / Megolm for messages, E2EE media via insertable streams
Daily encrypted backups with quarterly restore drills
Per-tenant rate limits and abuse isolation
GDPR DPA, sub-processor list, data-export on exit
Annual third-party penetration test

Questions teams ask before switching.

Do users need to install a new client?

No. Any Matrix client works: Element, FluffyChat, SchildiChat, Element X. You point the client at your domain; the homeserver address comes from .well-known.

Are calls really end-to-end encrypted?

Yes. Audio and video are encrypted in the client and decrypted in the other participants' clients. The SFU forwards encrypted frames, and TURN only relays ciphertext. The trade-off is the same one every E2EE conference has: server-side recording and PSTN dial-in are not available.

Can we keep federation?

Federation is on by default. You can restrict it to an allowlist, disable it entirely, or keep it open with per-room moderation. Federation traffic uses standard Matrix server-server TLS on 443.

What happens if we leave?

You export users, rooms and media through the Synapse admin API and keep the domain. There is no proprietary format and no exit fee. We schedule deletion 30 days after the last export.

Where is data stored?

Frankfurt or Helsinki, chosen at provisioning time. Backups are encrypted with a key we do not store next to the data, and retention is configurable per tenant.

Do you support self-hosting?

Enterprise tenants can run the same topology in their own cloud account with our deployment tooling and support contract. Starter and Team are hosted only.