You trigger it with nothing showing on screen. An operator receives location, audio and images.
is_test_user
account. No real alert is broadcast here.
On the phone, across 47 seconds: no sound, no KeepAlive notification, no icon changed. 0 traces.
Operator side, across 47 seconds: 7 events, location to within 8 m, 43 s of audio, 2 images, 1 operator assigned.
An attacker grabs your phone, demands the code, checks that no alert has gone out. Anything that shows (an SOS button, a lone-worker device, an emergency icon) is neutralised in seconds.
4,798
2021 data
offences of unlawful confinement recorded by the police and the gendarmerie in France.
French Ministry of the Interior, état 4001, index 10 “Unlawful confinement”.
108
2021 data
hostage-takings committed in the course of a robbery, recorded in France.
French Ministry of the Interior, état 4001, index 8.
235
2025 data
aid workers abducted worldwide, the highest figure since the count began in 1997.
An abduction is counted only when the person is held for more than 24 hours.
Humanitarian Outcomes, Aid Worker Security Report 2026.
And yet not a single iOS app today combines the three things that matter: total discretion (no visible button), a 24/7 human operator, and strict GDPR hosting in France. That is the gap KeepAlive fills.
How it works
The mechanism at the heart of it is a decoy: two PIN codes that look the same. Your attacker sees no difference; the operator is already alerted.
A “normal” code and a “duress” code. They look the same (1234 and 1235, for instance) and do the opposite. Only you know which is which.
You type the duress code. The app shows its usual screen while it streams location, audio and photos to the encrypted backend. Nothing appears, nothing sounds.
Live location, audio, photos, history. The on-call operator assesses the alert, listens, looks, then decides: call the emergency services (police, gendarmerie, ambulance) or acknowledge a false alarm. You have nothing to do.
The path of an alert
What the phone sends, in what order, and under what protection. The timings are measured on device, not targets.
Location, audio and images are sealed on the phone before they are sent. The private key never leaves the hardware enclave: Secure Enclave on iOS, hardware Keystore on Android.
TLS 1.2 as a floor, 1.3 where the network allows it, pinned on the leaf and on the intermediate. A proxy that inserts itself gets a refused connection, not a readable stream.
HMAC-SHA256 at source, fingerprint checked again on arrival, and each log entry seals the one before it. Remove a line and the chain breaks for every line that follows.
The on-call operator listens, looks, qualifies, then decides. No alert reaches the emergency services through a threshold or a model.
Audit log
A log you can add to but cannot retouch: each entry carries the fingerprint of the previous one. Take one out and every entry after it stops matching. Try it.
alert opened
location acquired
audio stream open
image received
case picked up
Illustrative fingerprints, computed over a demonstration set. No real alert appears here. In production the signing key never leaves the server and the verification can be replayed by a third party.
Real situations
Not textbook cases. Situations described to us in interviews, anonymised.
22:47 Underground car park
No time to call. Pulling out your phone would be a signal. Shouting would alert the attacker as much as any bystanders, and there are none.
With KeepAlive one discreet trigger starts audio capture and location. An on-call operator receives the alert, listens, and decides: verification call, or transmission to the emergency services.
21:07 Home
They know where you live and what you keep there. They want the safe, then your banking codes. Calling is out of the question: your phone is on the table, in plain sight, and you are not alone in the house.
With KeepAlive one trigger, phone held low at your side. Nothing changes on screen. The on-call operator receives the location of the house, the audio of the room and the images, assesses the coercion and alerts the emergency services while you play for time.
03:12 On assignment in Lebanon
You’re a journalist on a sensitive story. Calling the front desk may be a bad idea: you don’t know who is on which side.
With KeepAlive a silent alert goes to the on-call operator. GPS location, ambient audio, a photo if the app detects movement. The operator listens, assesses the situation and alerts the relevant local authorities if the threat is confirmed.
Under duress
Activists at a protest, an expat in an authoritarian region, a victim under domestic coercion: your code is demanded. Refusing raises suspicion. Giving the real code exposes everything.
With KeepAlive you enter the duress code. The app opens normally, the attacker scrolls through a mundane interface. In the background, the alert left from the 2nd digit you typed.
Honest comparison
No solution is perfect. Here, with nothing swept under the carpet, is where each one shines and where it falls short. Spot a mistake? Write to us and we’ll correct it.
| Criterion | KeepAlive | Lone-worker device (PTI) | BLE jewellery (bracelet, pendant) | WhatsApp / location sharing |
|---|---|---|---|---|
| Discretion | ||||
| Total discretion (nothing visible) | KeepAliveYes | Lone-worker device (PTI)Visible bracelet or badge | BLE jewellery (bracelet, pendant)Visible, but a piece of jewellery | WhatsApp / location sharingExplicit interaction |
| Works under duress (attacker has the phone) | KeepAliveDuress code | Lone-worker device (PTI)Button can be torn off | BLE jewellery (bracelet, pendant)Jewellery taken off | WhatsApp / location sharingCode demanded openly |
| Transmission | ||||
| 24/7 human operator | KeepAliveIncluded in the beta | Lone-worker device (PTI)Monitoring centre | BLE jewellery (bracelet, pendant)None | WhatsApp / location sharingNone |
| Webhook / custom API (employer integration) | KeepAliveDocumented API | Lone-worker device (PTI)Depends on the provider | BLE jewellery (bracelet, pendant)Closed platform | WhatsApp / location sharingNone |
| Strict GDPR, hosted in France | KeepAliveFrance | Lone-worker device (PTI)Varies by provider | BLE jewellery (bracelet, pendant)Often US cloud | WhatsApp / location sharingMeta · USA |
| No ad trackers | KeepAliveNone, declared to Apple | Lone-worker device (PTI)Dedicated hardware | BLE jewellery (bracelet, pendant)Companion app varies | WhatsApp / location sharingAd profiling |
| Limits | ||||
| Cellular autonomy independent of the phone | KeepAlivev1.3a in progress (LPWAN) | Lone-worker device (PTI)Native sub-GHz | BLE jewellery (bracelet, pendant)BLE, phone required | WhatsApp / location sharingPhone required |
| Monthly entry price, incl. VAT | KeepAlive€0 in private beta | Lone-worker device (PTI)€15 to €40, plus an operator subscription | BLE jewellery (bracelet, pendant)€5 to €15, plus €30 to €80 for the jewellery | WhatsApp / location sharing€0 (but it is not a safety service) |
Comparison compiled in May 2026 across the main French offerings (Magneta, Atrineo, Saphymo, Dring, Vivago, and others). The price ranges are public. Spotted an error? Tell us.
KeepAlive passes your alert to a human operator, who listens, works out what is going on, and calls the emergency services. We are not the police, the fire brigade or a response company: nobody is sent out because you pressed a button three times. What we guarantee is that someone will know where you are and what is happening there, without you having to say a word.
If you are in immediate danger and you can dial a number, dial it. These four come before us.
Private beta
KeepAlive is in private beta, by invitation. No charge, no commitment.
The public pricing grid and the final terms of sale will be published before the commercial launch. Registration is open: the TestFlight invitation link is delivered in your account area once you have created an account.