Hard Questions About Tabella
Last updated: July 2026
The FAQ answers the easy questions. This page is for the ones that actually matter — the ones a skeptical, technically-informed person would ask, answered without hedging, including where the honest answer isn't flattering.
Why not just use Signal's protocol directly?
Because "using Signal's protocol" isn't the small ask it sounds like. Signal's actual crypto library (libsignal) is open source, but it's licensed under AGPL-3.0 — a license that extends copyleft obligations to network use, meaning running it as part of a live service can require releasing large parts of your own server source code. Beyond the licensing, Signal's protocol is built around Signal's own server, account, and device model. Adopting it properly — not just borrowing a phrase for a comparison chart — would mean abandoning the Matrix platform Tabella is built on and building an entire custom server from scratch, the way WhatsApp did years ago. That's a full platform rebuild, not a component swap, and we don't think it's currently worth what it would cost.
There's also a more basic engineering reason: splicing cryptographic code from two different systems together is itself a security risk, not a safety improvement. The specific published concern people cite as "Signal's advantage" — a defense-in-depth check from a February 2026 security disclosure — has already been fixed properly, upstream, inside Matrix's own crypto library (vodozemac), merged March 2026. Tabella gets that fix by staying current on our dependency, not by importing someone else's code.
Isn't Matrix's crypto newer and less tested than Signal's?
Yes, honestly. Signal's protocol has had over a decade of the most intense cryptographic scrutiny any consumer messaging system has ever received — formally proven by academic researchers, attacked and re-analyzed continuously, running at a scale few systems ever reach. Matrix's Rust crypto library (vodozemac) has one full independent audit (Least Authority, 2022, publicly published) plus ongoing community review. That's a real, measurable maturity gap, and we're not going to pretend otherwise.
What we think that trade buys instead: a platform you can actually self-host, with no phone number requirement, built by a team small enough to build in the first place. Signal's minimalism and maturity come from being one thing, done by one team, for over a decade. Tabella is a broader, younger platform making a different bet — and the honest job in front of us is closing that maturity gap over time, not claiming it's already closed.
Why doesn't Tabella require a phone number?
Because a phone number isn't just contact information — it's a permanent, carrier-verified anchor to your real-world identity that you can't cheaply discard. Once you give an app your number, you can't take it back, and you've linked yourself into billing and identity-verification systems you never agreed to be part of just by installing a chat app.
There's a second, less obvious cost most people don't think about: contact discovery. Phone-number-based apps can reveal that you're on the platform to anyone who has your number saved — even if you never used the app publicly and never told them. Your number sitting in a stranger's phone is enough to expose your presence. Tabella uses a username and password instead, precisely to avoid tying your account to an identifier you can never revoke.
What happens if Wolf Pak Strategies is sold, or the founder leaves?
This is the question we take most seriously, because it's the one where good intentions today don't answer for what happens years from now. History is full of institutions that started with real, functioning checks and slowly lost them — not through a single dramatic betrayal, but through years of individually-reasonable decisions that each concentrated a little more control, until the checks were forms without substance. That risk doesn't require bad people. It just requires time and no structural insurance against it.
Our answer isn't a promise to stay good forever — nobody can credibly make that promise, and we're not going to pretend we can. Our answer is architectural: self-hosting is a first-class, permanent option, not a favor we could quietly withdraw. If Tabella's central operation ever became untrustworthy, anyone already running their own server keeps their private conversations private regardless — they were never depending on our continued good behavior in the first place. That's the actual point of building this on an open, self-hostable platform instead of a fully centralized one: it's insurance against a future led by people who aren't us, not just a feature for today.
Is Tabella just better than Signal, Telegram, and WhatsApp?
No, not across every dimension, and we'd rather say that plainly than let a comparison chart imply otherwise. On raw security maturity and audit depth, Signal is currently ahead of us — see above. What we believe we get right that the others don't: end-to-end encryption that's never optional, no advertising business model, no requirement to hand over a phone number, and a self-hosting option none of them offer at all. Different products are optimizing for different things. We think our trade-offs are the right ones for what we're building, but "different" and "objectively better at everything" are not the same claim, and we're not going to make the second one just because it sounds better in a pitch.