07 — Roadmap To Profit
They are not losing money on servers.
Every company in this market that is bleeding is bleeding somewhere specific, and it is almost never infrastructure. Understanding exactly where each of them leaks is how we know which of their costs we simply do not have.
Where the competition's money actually goes
| Company | What they sell | Where the money goes | The structural problem |
|---|---|---|---|
| Signal | Nothing. Donations. | Reported ~$50M a year — largely engineering headcount, plus the very real cost of running SMS verification and registration infrastructure for tens of millions of phone numbers | No revenue line at all. Covered by a founder's loan and giving, which their own leadership has publicly called a sustainability question |
| Telegram | Premium at roughly $4–5 a month, channel advertising, a token | Server-side storage of everything, because cloud chats are not end-to-end encrypted. They keep your messages, so they pay to keep your messages, forever, for a billion people | The business depends on holding content. It is also what makes them compellable — and their founder's 2024 arrest in France is what that risk looks like in practice |
| WhatsApp / Meta | Business API, click-to-message ads, and since June 2025 advertising inside the app | Enormous: identity infrastructure, the graph, ad-tech, trust-and-safety at two billion users, regulatory defence on several continents | Profitable, and cannot follow us. Identity is the asset, so removing it is not a product decision — it is an amputation |
| Threema | A one-time purchase, about CHF 6 | Modest. Profitable for a decade — the existence proof that paid, identity-free messaging works | No free tier, so virality dies at the paywall. Ten years to five to ten million users. And the store purchase re-attaches the identity the app avoided |
| Session | Token staking | A decentralised node network and the token economics that sustain it | Came within days of shutting down in July 2026. And by their own documentation, no forward secrecy yet |
| SimpleX | Nothing. Donations and investment. | Small, radical, well-audited engineering | Signal's fragility on a much smaller network |
| Spojiti | Free text for life; Premium for everything with a marginal cost | Five people working for equity, AI agents, counsel, and a server bill that is a rounding error | No users yet. Everything above is somebody else's proven business; ours is not proven at all |
Two of them are profitable and both hold something we refuse to hold. Four of them are subsidised, and three of those four refuse to hold it too. The market has never seen a company that refuses identity and is paid by its customers. Threema comes closest and stopped short of a free tier, which is why it is a good business and not a large one.
The four things that actually constrain our price
It is tempting to believe the server bill sets the floor. We worked through it properly and it is fourth out of four.
| # | Constraint | Size | Ours to control? |
|---|---|---|---|
| 1 | The app store's cut | ₹75 to ₹150 per paying user per year on a ₹499 subscription. Several times what the entire infrastructure costs to serve that user. | Partly — our own web rail is the lever, and the blind-signed voucher that makes direct billing possible without linking payment to identity is already built. This is the monetisation-architecture edge, and it is larger than the server one. |
| 2 | Fixed trust costs | The audit alone, at the ₹63 lakh ceiling, is hundreds of thousands of blended user-years at a realistic conversion rate. And it recurs — Signal re-audits. | No. These do not scale down. This, not the server bill, is the number that belongs on the wall. |
| 3 | Customer acquisition | Unquantified, and probably decisive. You cannot buy a user profitably at this revenue per user. | No. Price has to be set by what the organic funnel converts, never by what our costs permit. Signal grew on events and word of mouth, not spend — and so must we. |
| 4 | Infrastructure | $25 to $40 a month for the entire fleet today. | Yes — and it is the smallest of the four. Genuinely excellent, genuinely not the binding constraint. |
What a year looks like at each size
Forget the ramp for a moment. This is the same arithmetic asked a simpler question: at a given number of users, what does a year look like? At our base case of paid conversion.
The infrastructure column is the thesis. It is a falling share of revenue at every rung, because an end-to-end encrypted relay that deletes on delivery has almost nothing to store — WhatsApp famously served around nine hundred million users with roughly fifty engineers on this class of architecture. Note that this table excludes company overhead (counsel, salaries, entity costs), which is material at ten thousand users and noise at ten million; the year-by-year projections on The Pitch carry it in full.
Our internal model has long quoted infrastructure at under one per cent of revenue. That figure is real but it assumes a third of all users pay — a modelling convenience from an earlier design, never a forecast. At a realistic conversion the honest range is of revenue at a million users falling to at a billion. Still the smallest line in the business. Not one per cent, and we are not going to print one per cent.
The order of operations
A profitable model is not a plan. This is the plan, and each step exists because the one before it made it affordable.
- Launch publicly and survive it. The load model says one core carries roughly two hundred messages a second and twenty-five to forty thousand held connections; we have proven twenty thousand concurrent sockets on a single two-core box at seventeen per cent CPU, and five thousand concurrent with live messaging at 99.6% delivery. The founder's pre-launch bar of sixteen thousand concurrent with messaging is a multi-core number and it is not proven yet. Clustering is the next piece of work.
- Commission the audit immediately. Firms book two to four months out and the work plus fixes plus a re-test runs six to ten weeks. Engaged at launch, the report lands in 2027. This is the single highest-leverage thing the round buys.
- Open the source when the audit is engaged, and publish the report when it lands. The extraction tooling already produces a core whose crypto and networking files are byte-identical to what ships in the store build.
- Turn on the web rail properly, so the store's cut becomes a choice rather than a default. The rail is built; the habit is what has to be built.
- Then Echoes, which is a second business on the same infrastructure and the same promise.
What would break this
Stated plainly, in the order we actually worry about them.
- We launch and nobody comes. The cold-start problem is real and we have no evidence against it. Our answer is narrow — we do not ask anyone to move their whole life, only the one conversation that matters.
- A privacy incident of our own before the audit. It would be existential to the brand and there is no recovering it. It is the reason the audit is first in the queue.
- Store policy. Apple and Google control our distribution and, on one rail, our billing. We are approved on both today.
- Signal ships username-only registration properly and crowds our wedge. It would not remove our payment rail or our post-quantum authentication, but it would take the headline.
- Key-person concentration. Five people, none of them yet paid, and the deepest knowledge of the cryptography sits with very few of them. Paying the team is the first thing the round does after the audit, and it is a retention question as much as a fairness one.
- Regulatory drift in our home jurisdiction, which we manage rather than solve.