What inspired you to build City of Hats, and what specific gap in secure messaging were you aiming to solve with location-controlled messages?
Stephane Vaillancourt: City of Hats was inspired by
In real-world scenarios —
City of Hats introduces location-controlled encrypted
Beyond messaging, the
What specific use cases have you identified where location-locked messaging provides clear value over traditional secure messaging apps?
Stephane Vaillancourt: Location-based access control, combined with secure chat, voice, and video calling, enables entirely new workflows:
- Enterprise & finance: Encrypted calls or file sharing that only work inside corporate facilities — preventing data from leaving the building, even digitally
- Journalism & whistleblowing: Anonymous sources can submit Sealed Tips or use Dead Drops without exposing their identity, and communicate via Hat-to-Hat voice calls with no phone number required
- Events & conferences: On-site communication tied to physical presence — attendees register with Hats, keeping personal data private
- Government & defense: Controlled access to encrypted communications within designated secure zones
- Partnerships & M&A: Confidential discussions via secure Hat-to-Hat calls and self-destructing document sharing, with no identity trail
This transforms communication from simple encrypted messaging into context-aware secure interaction — where access depends on identity, location, and conditions, not just a password.
As the product scales, do you see City of Hats evolving into a niche security tool or a broader communication platform for mainstream users?
Stephane Vaillancourt:We see City of Hats evolving into a privacy-first communication platform for both enterprise and everyday use.
Features like location-controlled messaging, GeoLock, and anonymous identity layers appeal strongly to enterprise and security-conscious users. But the addition of end-to-end encrypted voice and video calling between Hats makes the platform practical for anyone who values privacy.
Users can:
- Chat securely with end-to-end encryption
- Share files via self-destructing Dead Drops
- Make voice or video calls — Hat-to-Hat, with no phone number required
- Use disposable identities that auto-expire after 24 hours
All of this without linking their identity to a phone number or email. City of Hats is a next-generation secure communication platform — not just a niche tool.
How does your location verification—through telecom networks or GPS—ensure accuracy and prevent spoofing or misuse?
City of Hats uses a hybrid location verification approach:
-
Telecom network verification (e.g., AIS/Orange network APIs) for high-trust, carrier-level validation that’s difficult to spoof
- GPS-based verification for broader global coverage
These methods work as a conditional access check — the system verifies whether a user is within an approved area at the moment of access, without storing precise location history or continuously tracking the user.
This means a GeoLock-protected message can require physical presence in a specific zone to decrypt, while the platform still respects user privacy by treating location as a momentary condition, not stored data.
In what real-world use cases do you see location-locked messaging having the most impact, especially compared to platforms like Signal or WhatsApp?
Stephane Vaillancourt: Signal and WhatsApp focus on encryption in transit — they protect messages from being read by third parties, but once delivered, there are no further access controls.
City of Hats extends that model with three additional layers:
- Conditional access control: Messages, files, and media can be restricted by location (GeoLock), time (time-lock), read count (view-once, burn-after-read), or even biometric verification
- Identity abstraction: Users communicate via temporary or permanent digital identities (“Hats”) — no phone number, no email, no real name
- Encrypted voice and video calling: Hat-to-Hat calls with the same privacy model — no personal contact details exchanged
The result: even if communication is intercepted, leaked, or shared, it cannot be accessed outside the defined conditions and cannot be linked back to a real identity.
We also publish a Warrant Canary for transparency — something few messaging platforms offer.
How are you addressing privacy concerns, particularly around user location data and how it is stored or processed?
Privacy is foundational to City of Hats — it’s not a feature, it’s the architecture.
The platform operates on a zero-knowledge architecture:
- Messages are end-to-end encrypted with AES-256-GCM via the Double Ratchet protocol
- The server never sees plaintext, private keys, or encryption keys
- Sealed sender hides the message author from the server itself
- No phone number or email is required to use the platform
- Cover traffic masks communication timing patterns
For location specifically: verification is treated as a momentary condition, not stored user data. The system can confirm whether a user is within an approved area without recording or retaining their precise coordinates. No location history is ever stored.
Dead Drops self-destruct after retrieval or expiration. GhostFrame messages are embedded steganographically in images. Session keys are ephemeral. Even under legal compulsion, there is no meaningful user data to produce.
Disclaimer: This Q&A is part of TechBeat’s editorial series and reflects the views and information provided by the interviewee. TechBeat has not independently verified all technical claims or product capabilities mentioned above.
