About Sanctum
Source Code available on GitHub https://github.com/AlsatianConsulting/sanctum
Sanctum turns a spare Android phone into a leave-behind sentry. You put the
device in a room, arm it, and walk away. When something disturbs the room,
Sanctum records what happened, encrypts it on the device, and sends you a Signal message saying what tripped and when.
It is built for the person who needs to know whether a room was entered while
they were not in it. Its governing rule is that it never claims to be watching
when it is not.
WHAT IT WATCHES
Six sensors, each independently switchable, each with a trigger line you set
yourself against a live meter:
• Sound, in dBFS against a baseline calibrated to the room
• Movement, when the device is moved or tilted
• Vibration, sustained — footsteps, a door
• Ambient light, when the level changes
• Power, when the charger is connected or disconnected
• Picked up, when the device is lifted from flat, however slowly
Several sensors firing at once is one incident, not six. A door opening changes
the light, vibrates the table and makes a noise; Sanctum correlates those into
one event naming every sensor that contributed.
WHAT IT RECORDS
Photographs from both cameras, audio when the sound sensor trips, and optionally video. Everything is encrypted with a key held in the phone's hardware keystore before it is written, never after. The incident database is SQLCipher.
Deleting an incident destroys the key protecting its evidence, so deletion is
cryptographic. Sanctum makes no claim that bytes are overwritten on flash.
HOW IT TELLS YOU
Alerts go out over Signal from a dedicated account on the device, end-to-end
encrypted, to people you nominate. The message goes first and says what tripped.
Photographs follow if you have asked for them. Audio and video stay on the
device unless you ask for them by name.
You can also instruct it over Signal from anywhere: ask its status, arm or
disarm it, switch sensors on and off, move trigger lines, or record the room for
a fixed length and have the clip sent back.
Only accounts you have approved in person, on the device, are obeyed. Everyone else is met with silence rather than a refusal — a reply of any kind would confirm the number belongs to a device that is listening.
No command destroys anything. An attacker holding an approved phone can stop it watching, loudly audited, but cannot erase what it already saw.
IT SAYS WHEN IT STOPS
A reboot, an upgrade, a force-stop, a revoked permission — anything that stops
monitoring produces a message saying so. A monitor that goes quiet without
saying so is the failure this application exists to avoid. Sanctum never claims
uninterrupted operation.
WHAT IT DOES NOT DO
• No account, no cloud, no server, no telemetry, no analytics
• No Google Play Services, Firebase or FCM — the build fails if one appears
• No logging: there are no logcat calls in the app at all
• No covert mode. Monitoring always runs a visible foreground service with an
ongoing notification, and always trips Android's camera and microphone
privacy indicators. This will not be made optional
• No face recognition, person identification, or behavioural profiling
• No SMS fallback. If Signal cannot deliver, the alert queues rather than
downgrading to an unencrypted channel
WHAT YOU NEED
A phone running Android 8.0 or later, dedicated to this if you can. A phone
number the device can receive an SMS or voice call on: it becomes the device's
own Signal account and is signed out of Signal everywhere else. A second phone with Signal to receive alerts. Signal's registration challenge must be solved by a person.
Free software under AGPL-3.0-only, drawing on Haven (Guardian Project) and on Molly and Signal-Android. Not affiliated with Signal Messenger LLC, the Molly project, the Guardian Project, or Google.
Alerts are indicators that a sensor threshold was crossed. They are not proof of an event, and not proof of who caused it.
