After dark¶

Before the move, the Home’s chat was Teams by day and the Coven by night. Teams lived in the tenant, with guest access nobody had reviewed and notifications that did not reliably reach the older phones the night shift carried, or reached them with a sound one vampire described as aggressively cheerful in a way that felt personal. So the night shift, being staffed by people who are awake when the helpdesk is not, made its own arrangement: a Signal group Nikolaj created on his personal phone one night when three residents needed concurrent attention and the official system was down. Two years later it had fourteen members, three of them former volunteers nobody had removed, and it carried the shift handovers, the feeding changes, and Dr Flannel’s overnight medical notes, one of which described a resident’s psychiatric diagnosis in terms Madame Zara called reductive but unfortunately accurate. The scraps for this layer say: the night shift was right about the need and wrong about the tool, and both halves have to be true at once.

What the night shift needed¶

The Teams page already says the underlying need is legitimate. A handover at three in the morning has to reach four people on four phones inside a minute, and it has to be written by someone with a resident in one hand. Any chat that fails that test gets replaced by one that passes it, whatever the policy says. So the first scrap was a list of what the replacement had to do at 03:00 on an old phone, and the Home’s IT wrote it with Nikolaj, who had been running the real system for two years.

Signal, read¶

Signal is very good at end-to-end encryption, and the Coven page says that reassurance was offered whenever the group came up. The legal page says the rest: Signal Messenger LLC, Mountain View, California, disputes in the Northern District of California under California law, a 501(c)(3) foundation behind it. A US non-profit is a better landlord than most, and it is still a US landlord, and the messages were on fourteen personal phones the Home did not manage, three of them belonging to people who had left. The encryption protected the content in transit. It did not protect it from being on the wrong phone.

The landlord after dark¶

The chat went to Threema Work, from Threema AG of Pfäffikon in the canton of Schwyz. Its page says the services are operated exclusively on Threema’s own servers in Switzerland, in an ISO 27001 colocation in Zurich, that no phone number is needed to use it, and that NGOs get preferential terms on licences that otherwise start at three francs or euros a month per user. Two things on the list mattered more than the price. A Threema Work licence belongs to the Home and is revoked from a dashboard, so a volunteer who leaves is out of the chat the same day, and nobody at the Home could do that to a Signal group. And it does group calls, Teams’ job by day, so the day shift moved as well and the Home has one chat instead of a sanctioned one and a real one.

Threema OnPrem, the version that runs on the Home’s own machines, went into the notes beside it as the road out if the service ever stops.

The phone in the pocket¶

The scrap that took longest to write was about the phones, because the phone is where the US dependency in any chat lives and no provider removes it. On Android, Threema’s FAQ says the app uses Google’s push service by default to wake up for a message, and offers Threema Push as the alternative for anyone who prefers not to rely on Google services. On an iPhone the wake-up call comes from Apple, and there is no alternative. So the night shift’s Android phones run Threema Push and reach Threema’s servers directly, the iPhones wake through Apple, and the note says so, because a chat that is Swiss end to end still has an American company deciding whether the phone buzzes.

The device replacement programme that the Coven page describes as partially approved got its other half. The night shift now carries phones the Home owns, on which the Home can install, update and wipe, so a lost phone is a lost phone and not a lost archive.

Its own door¶

Whether Threema Work takes the Home’s identity provider is not on its public pages, so the chat keeps its own door, like the mail: a licence per person, issued and revoked from the Home’s dashboard, and one administrator account with its own second factor that the identity page counts among the four.

What stays in the chat¶

Dr Flannel’s overnight notes were the reason the DPO cared, and they did not move to the new chat. They go into Bestiary, where medical status belongs, and the chat carries the line that says a note is there and which resident it is about. The shift schedule went back to being the schedule, with the spreadsheet retired in favour of the volunteer roster that the Burrow page moves. What the chat holds now is chat: who is on, what happened, what needs the morning team, and the running commentary on whether the thing in the basement is nocturnal or simply indifferent to time, which no data protection review has ever objected to.

Lights out¶

   Threema Work, Pfäffikon ── Threema's own servers, Zurich
              │
       licences the Home issues and revokes ── one admin, own second factor
              │
   ┌──────────┴──────────┐
   day shift            night shift
   (was Teams)          (was the Coven)
              │
   Home-owned phones ── Android: Threema Push, no Google
                        iPhone: Apple's push, no alternative

   the medical notes: in Bestiary, not here

The American companies left in the path are named on the note: whoever makes the phone decide to buzz.

What could go wrong?

• Threema AG suspends the account, and the Home is back to phone calls and the whiteboard until Threema OnPrem or another provider is up, a bad night and nothing lost.

• Apple’s or Google’s push service stops serving Threema, and messages wait until somebody opens the app, which on a night shift means somebody looks at the phone anyway.

• A former volunteer still has two years of the Coven on a personal phone, because nothing the Home does now reaches the past.

• A resident’s medical note goes into the chat again at 03:00 because Bestiary was slow, and the DPO’s review finds it in the export.

The chat provider is gone, what now? The handover happens by phone call and on the whiteboard in the night office, as it did before Nikolaj’s group. The licences, the phones and the people are the Home’s, so a new chat is a day’s setup, on Threema OnPrem in the comms room or at another provider, and the medical notes never left Bestiary. What is lost is the running commentary, which the night shift has been known to reconstruct from memory with improvements.

Witches do their best work after dark, and none of it gets written down where a bishop could read it.