Fully Managed MollySocket
as a Service

Deploy MollySocket as a fully managed service starting at €9/mo. Get automated backups, SSL, updates, support and monitoring included.

MollySocket is a notification relay for Molly, the hardened Android client for the Signal messaging network. It holds the always-on connection so the handset does not have to, then forwards a content-free wake-up through UnifiedPush, giving Google-free phones the responsiveness of a push service without one.

✓Free 7-day trial  ✓99.9% Uptime SLA  ✓No credit card  ✓Cancel anytime

✓Free 7-day trial  ✓99.9% Uptime SLA
✓No credit card  ✓Cancel anytime

MollySocket

MollySocket

STARTING AT

€9/month
Automated Backups
Monitoring
Automated Updates
Auto SSL

USAGE

Unlimited
Human Support
Custom Domains
Terminal Access
File Manager Access
Deploy in your region — 21 locations worldwide
GermanyFinlandNetherlandsUKSwedenUnited StatesCanadaSingaporeJapanAustraliaBrazilSouth Africa+9 more →
MollySocket Preview Image

ABOUT THE SOFTWARE

What is MollySocket

MollySocket is a small relay that lets a phone running Molly receive message notifications without any Google service in the path. It keeps the connection to the messaging servers open on your behalf and nudges the handset through UnifiedPush when something arrives.

The project is published by the mollyim organisation, the same group that maintains Molly itself, under the GNU Affero General Public License version 3. It is written in Rust and ships as a single binary with a SQLite state file, listening on one HTTP port for the pairing handshake and nothing else. There is no web interface to log into, no user database and no message store, because it has nothing to store.

Mechanically it registers as a linked device that is deliberately never given any encryption key. It can see that an encrypted event has arrived; it cannot open one. What it sends onward is a bare wake-up to whichever UnifiedPush distributor you have chosen, and the phone then fetches and decrypts the message itself. DANIAN is an independent operator of this software and is not affiliated with, sponsored by or endorsed by Signal Messenger LLC.

FEATURES

What MollySocket does

The feature list is short by design. It is one job done carefully: hold the connection, notice the event, wake the phone, and get out of the way. Everything below describes the software itself rather than the platform it runs on.

Push without a proprietary push service

Delivers message alerts to handsets that have no Google services installed at all, using the open UnifiedPush path instead of the vendor one.

No encryption keys, by construction

Registers as a linked device that is never handed a key. It can detect an encrypted event and nothing more, so the relay operator cannot read what passes through.

Standard linked-device connection

Works entirely through the ordinary linked-device mechanism, so it needs no cooperation from, and makes no modification to, the messaging service it connects to.

Air-gapped pairing mode

Registers a connection from the command line with no web listener exposed at all, printing the pairing code to the service log for teams that want no public surface.

Several accounts on one instance

Accepts a list of account identifiers and maintains a separate connection and delivery target for each, so a whole desk shares one relay.

Account and endpoint allowlists

Two independent controls decide who may register against the instance and which push servers it is willing to deliver to.

Distributor-agnostic delivery

Works with any UnifiedPush distributor, public or self-hosted, with request signing so your own push server can verify that the delivery came from your relay.

Small, boring runtime

One Rust binary, one SQLite file, one long-lived connection per account. Nothing to cluster, nothing to tune, and very little to go wrong.

WHAT'S ALWAYS INCLUDED

Every app. Fully managed.
Nothing extra to pay for.

Every app on DANIAN ships with the same operational baseline. You do not choose a backup add-on or a monitoring tier. Hosting, patching, backups, SSL, and support are part of the €9, and they apply to MollySocket the same way they apply to everything else in the catalog.

Automatic updates and patches

Apps run the latest stable version. Security patches applied silently, with rollback if needed.

Daily off-site backups

Multiple daily backups in redundant off-site locations. One-click restore if anything goes wrong.

24/7 uptime monitoring

Continuous monitoring with instant alerting. We respond before you notice.

SSL, firewall, DDoS protection

Auto-renewing SSL, hardened firewall rules, DDoS mitigation on every deployment.

Performance and scaling

We monitor resource usage continuously. When your app needs more headroom, we flag it and upgrade with your explicit approval.

Dedicated engineering support

Real engineers by email and ticket. DNS, SMTP & migration help. All included in €9.

WHY MANAGED

Why teams pick managed MollySocket

Device attestation has tightened to the point where de-Googled handsets are a deliberate choice rather than an accident, and the teams making that choice still need notifications to arrive. A relay is the piece that makes it practical, and it is also the piece that quietly stops working.

Running the software is genuinely easy. Keeping it running is the part nobody budgets for. The connection to the messaging servers can close with a connected-elsewhere status and simply not come back, at which point pushes stop and nothing tells you. Linked devices that go quiet are removed by the messaging service after a set inactivity window, and only the primary handset can restore one. And when the messaging service changes its authentication method on the server side, the relay needs a new build the same week or it stops connecting at all.

The default configuration is the other trap. Out of the box the software accepts any account identifier and any delivery endpoint that can reach it. That is a reasonable default on a laptop and the wrong one on a public address, where it means a stranger can register against your instance and burn your rate limits. Anyone putting this on the open internet has to fix that before anything else, Most setup guides mention it in passing, near the end.

We provision against those failure modes rather than documenting them. What arrives is configured, supervised and watched:

Account identifiers restricted to yours at provisioning the accept-anything wildcard is never left on.

Delivery endpoints allowlisted explicitly, so a self-hosted push server works and an unknown one is refused.

TLS terminated in front of the app with the original host header preserved, which is what stops the pairing screen throwing an origin error.

Pairing key generated at provisioning and stored outside the state file, so restoring a backup never silently rotates it.

Process supervised with restart-on-exit, plus an external delivery probe so a stalled connection raises an alert instead of a missing message.

REVIEWS

Hear from customers ​like you​​​​​​​

Successful businesses and professionals around the world rely on DANIAN every day

USE CASES

Three teams who run MollySocket on DANIAN

The buyers here are not hobbyists. They are small groups who chose Google-free handsets for a reason connected to their work, and who need the notification path to be dull and dependable. Three shapes we see repeatedly.

4-PERSON INVESTIGATIVE DESK

One relay for the desk, paired without a public page

A regional newsroom's investigative team runs Google-free handsets. The relay is provisioned in air-gapped mode, so there is no pairing page on the open internet at all, and each reporter's account identifier is added to the allowlist by hand. The region is picked to sit near the newsroom for round-trip time.

2-PARTNER CRIMINAL DEFENCE PRACTICE

A firm-branded address, on the firm's own domain

Both partners take client contact on hardened phones. The instance runs on a subdomain of the practice's own domain with the certificate handled for them, and the endpoint allowlist points at a single push server. Nothing about the matter ever reaches the relay, which is the point.

6-PERSON DISCLOSURE TEAM

Locked to their own push server, nothing else

A vulnerability-disclosure team wanted the entire notification path under their own control. They run their own push server; we allowlist that endpoint and refuse every other one. Six account identifiers share one instance, each with its own connection and its own delivery target.

COMPARISON

Four ways to run MollySocket

The honest comparison is not four prices, it is four kinds of work. Below, the proprietary path charges per person, the two self-run paths charge you in attention, and the managed path is flat. At one seat the subscription is cheaper; the crossover is quick.

Path1 person5 people10 peopleWhat it costs you beyond money
Proprietary secure-messaging subscriptionThreema Work Core, per user, billed annually3.00/mo15.00/mo30.00/moNo relay to run at all. But it is per seat, it scales linearly forever, and it means moving the whole team onto a different network from the one your contacts already use.
Self-host on a VPS$24/month production-class VPS$24/mo$24/mo$24/moFlat, and cheap for a large team. You own the reverse proxy, the certificate, the allowlists, the supervision, the forced updates and the 3 a.m. reconnect. Budget an hour a month when nothing is wrong.
Home serverSingle-board host, one-time hardware~€160 once~€160 once~€160 onceLowest running cost and a few euro a year of electricity. Your uptime is now your home connection and your power supply, and the one thing this app must be is reachable.
DANIAN managed MollySocketFlat, regardless of how many accounts share it€9/mo€9/mo€9/moOne instance serves the whole team. Backups, certificate, allowlists, supervision, forced updates and monitoring are ours. You pair a phone and then stop thinking about it.

Prices for the proprietary path are its published list rates at the time of writing and are per seat on annual billing. The self-run paths look cheapest on the spreadsheet because the spreadsheet has no column for the evening you spent working out why notifications stopped four days ago.

BY INDUSTRY

MollySocket for specific industries

Four fields where confidential contact is a professional duty rather than a preference, and where the rule that applies is written down somewhere specific. Each block names the standard, the configuration choice we make for it, and the number that shapes the setup.

Source protection is a legal position, not a preference: reporter's privilege is recognised by shield laws in 49 US states plus the District of Columbia, and the Reporters Committee for Freedom of the Press maintains the state-by-state compendium desks actually work from. For a desk we provision in air-gapped mode, which means the pairing handshake happens from the command line and no pairing page is ever published, and we add each reporter's account identifier to the allowlist individually. In practice a tip lands, the desk's handsets wake within seconds, and no third-party push service ever learns that a message existed. The number that shapes the setup is five: the messaging service caps linked devices per account at five, so a desk plans one shared relay rather than one per reporter.


ABA Model Rule 1.6(c) requires a lawyer to make reasonable efforts to prevent unauthorised access to information relating to a representation, and Formal Opinions 477R and 483 apply that duty directly to electronic communication. For a practice we run a dedicated instance on the firm's own subdomain, terminate TLS there so the address a client sees belongs to the firm, and keep the state file on encrypted storage. A client messages the defence line from a hardened handset, the relay wakes the phone, and the message itself is fetched and opened only on the device. The relevant number is five seconds: the relay collapses repeated events into one wake-up per five-second window, so a fast exchange costs one notification rather than forty.


The sector reference for handling contact data is the ICRC Handbook on Data Protection in Humanitarian Action, produced with the Brussels Privacy Hub, which treats minimising what any intermediary holds as the starting position rather than a hardening step. That maps onto a relay that holds no keys and no message content by construction. For field teams we place the instance in the region nearest the operation rather than nearest the head office, because round-trip time to the coordination desk is what people notice. The number here is twenty-one: with 21 datacenter locations, a team working on a different continent from its headquarters can put the relay beside its people and still let HQ pair from where it sits.


Coordinated disclosure runs on ISO/IEC 29147 for receiving vulnerability reports and ISO/IEC 30111 for handling them, and both assume a contact channel the reporting party can trust and the receiving team actually watches. Teams like this usually run their own push server, so we set the endpoint allowlist to that server alone and refuse every other destination, which means a misconfigured client cannot quietly route wake-ups somewhere else. A report arrives out of hours, the on-call researcher's handset wakes, and the triage clock starts. The number that matters is one: a single instance carries the whole team's accounts, each with its own connection, for the same flat monthly price.


FAQ

Frequently asked questions

Three groups below. The first covers how the relay behaves and what we set differently from a stock install, the second covers moving an existing setup across and getting paired, and the third covers billing, support and how the platform works generally.

01

Technical and configuration

No. It links as a device that is never given any encryption key, so it can tell that an encrypted event arrived but cannot open it. What it forwards onward is a bare wake-up with no content. Your phone fetches and decrypts the message itself.
It holds linked-device credentials, not identity keys. Someone with them could exhaust rate limits on the messaging servers and make a nuisance of themselves, but cannot impersonate you or read history. We keep the state file on encrypted storage and restrict the instance to your accounts.
Only the ones you name. The stock configuration accepts any account identifier that can reach the address, which is fine on a laptop and wrong on a public host. We set that list to your accounts at provisioning and never leave the accept-anything wildcard switched on.
Any you allowlist. A second list governs which UnifiedPush servers the relay will accept as a delivery target. A public distributor works immediately; a self-hosted push server has to be added to that list, or delivery is refused with an endpoint error.
It reconnects, usually. The failure people actually hit is a close with a connected-elsewhere status, after which pushes stop silently. We supervise the process, restart on exit, and probe delivery from outside, so a stalled relay surfaces as an alert rather than as a message you never got.
Yes, and yes. The software does not terminate TLS itself and the phone will only pair over HTTPS. We run the certificate, renew it, and pass the original host header through the proxy, which is the specific thing that stops the pairing screen rejecting the address as a bad origin.
Yes. The account list takes several identifiers, and each gets its own connection to the messaging servers and its own delivery target. A small team normally runs one shared instance rather than one per handset, which is why the flat price works out the way it does.
It signs delivery requests so your push server can verify they came from your relay, and the pairing code will not appear until one exists. We generate it at provisioning and store it outside the state file, so restoring a backup never silently rotates it underneath you.
Very little. It is one binary with a small SQLite file, holding a single long-lived connection per linked account. Memory sits in the tens of megabytes for a team-sized deployment, which is why one flat plan carries a whole desk without any scaling conversation.

02

Migration and onboarding

21 datacenter locations across six continents. You choose the region at provisioning. Application data sits in the region you choose; pick whichever is closest to your users or matches your data-residency preference.
Yes. Request a region migration from the dashboard and we run the move in the background. The system emails you when the migration completes; total transfer time depends on data volume but typical instances finish in a few hours. There is no extra charge for a region change.
Yes. Full data export is available at any time, in a portable format you can bring to any infrastructure.
Re-pairing is usually faster than copying state. Point the phone at the new address, scan the code, then remove the old device from your linked devices list. No message history moves, because the relay never held any in the first place.
One sitting. You pick a region, we provision the instance and hand you the address, and you open the notification settings on the handset, choose UnifiedPush and scan the pairing code. Most of the elapsed time is finding the phone.
Yes. Air-gapped mode skips the listener entirely and registers the connection from the command line, printing the pairing code to the service log. Tell us which mode you want when you order and we provision it that way from the start.
Yes. Point a record at the address we give you, or ask support to walk through it with you, and the certificate is handled from there. Domain questions are inside the plan rather than priced as a paid extra.
You re-pair from the phone. Linked devices that go quiet are removed by the messaging service after an inactivity window, and only the primary handset can restore one. We watch the connection and tell you when it stops, instead of leaving you to notice the silence.
Seven days, no card. Provision an instance, pair a handset and see whether notifications arrive the way you need them to. If it is not right, cancel from the dashboard and nothing is charged.

03

Billing, support, and platform

€9 covers everything we do for that app: hardware in the region you choose, daily off-site backups with one-click restore, automatic security patches and version upgrades, 24/7 monitoring, SSL and firewall, and engineering support on email and the ticket section in the client portal. There are no setup fees or hidden line items. For more info see our Pricing page.
If you decide to continue, we charge €9/app/month from day 8. If you don't, the trial ends and you can export your data. No card is required for the trial, and we never auto-charge you without explicit consent.
No. The €9/month is flat regardless of how many users log into your app. Add 5 users or 50; the price doesn't change.
24/7 email and ticket support, both staffed by engineers who run the systems. We handle DNS configuration, SMTP setup, app integrations, performance tuning, troubleshooting, and migration help. Response time is typically under an hour. There is no tier system — every customer gets the same support.
Yes. Cancel from the dashboard. We don't charge a cancellation fee, we don't lock data, and we will export your data to you on request before deletion. data to you on request before deletion.
Every customer instance is backed up daily to a separate region from the primary. We test restores. You can request a restore at any backup point within the retention window — usually 7 days for daily backups.
Your application data sits in the region you choose at provisioning — 21 datacenter locations across six continents. Account-level data (billing, account email, support ticket history) is processed centrally. Application data region is picked by you, per app.
99.9% uptime SLA on every app, every tenant. Service credits are documented at danian.co/service-level-agreement. The status page is located at status.danian.co.
When your tenant approaches the resource ceiling — the base tier holds 1 vCPU/RAM, 30 GB storage — we notify you. Resource upgrades happen with your explicit consent; we will not upgrade your tenant or charge you without it.
We wait. We don't suspend the app or delete your data on the first failed charge. We email you, you fix the card on file, and we continue.
Invoices can be downloaded from the billing dashboard in PDF the day each charge succeeds. EU VAT is added where applicable and the VAT-reverse-charge regime applies for VAT-registered businesses with a valid number.
150+ open-source apps across automation, team chat, file sync, analytics, AI, password management, email marketing, dev tools, project management, smart home, CMS, and federated social. See the full catalog →
Yes. Every instance comes with a web-based terminal and a file manager in your DANIAN management dashboard. Useful for managing your data and customizations.
Resources scale with your usage. If your app needs more vCPU, RAM, or storage, we add it — and we ask first before any change to your plan. €9 is the floor; resource-heavy workloads may price higher, but you'll always know in advance.
Yes. We have both a Partner program and an Affiliate program available. Anybody can sign up.
No contract. No minimum commitment. Cancel anytime from the dashboard with one click. The 7-day free trial requires no credit card. After the trial converts to paid, you can still cancel at any month without notice or penalty.

DEPLOY IN YOUR REGION

21 datacenter locations on six continents

Pick the region closest to your users.

United States, Germany, Finland, Singapore, Australia, Brazil, Canada, Netherlands, UK, Spain, Italy, France, Sweden, Malaysia, India, Japan, Mexico, Poland, South Korea, Chile, South Africa and more coming soon

Global Reach Map

Try managed MollySocket for 7 days

No card. Cancel from the dashboard.