HAMAWhy a regular messenger is not enough
The need to choose a corporate messenger in Uzbekistan usually arises when employees handle work conversations in public apps like Telegram or WhatsApp. It looks convenient, but it creates serious risks for the organization: data is stored on foreign servers, access cannot be controlled, and when an employee leaves, the entire chat history stays on their personal device.
A corporate messenger is built precisely to solve these problems: it gives the organization control over data flow, management of access rights, and compliance with security requirements. That is why the selection should focus first on technical and legal criteria, not the interface.
Criteria for choosing a corporate messenger
This checklist helps evaluate any vendor. Mark each item as "yes / no".
1. End-to-End (E2E) encryption
Messages must be decryptable only on the sender's and recipient's devices. The server should not be able to read the content. Trustworthy solutions use protocols that have become an industry standard (for example, the Signal protocol) and TLS 1.3 at the transport layer.
2. Data in Uzbekistan or on-premise
Find out exactly where the server physically resides. For government bodies and critical infrastructure, data must be stored within the country or directly on the organization's own servers (on-premise).
3. Compliance
- O‘z DSt ISO/IEC 27001:2023 — the information security management system standard;
- PP-167 — requirements for protecting critical information infrastructure;
- the vendor's readiness for these requirements and the supporting documentation.
4. Admin control and RBAC
The organization must be able to add/remove users, assign permissions by role (RBAC), review an audit log, and instantly block access when an employee leaves.
5. Integrated modules
A single platform is preferable to a set of separate apps: video conferencing, tasks/helpdesk, activity monitoring, time tracking. This keeps data from being scattered across multiple services.
6. Local support and a Windows client
A team operating in the Uzbekistan market, support in Uzbek/Russian, and a corporate Windows client (centralized deployment via MSI) are important practical criteria.
Common mistakes when choosing
- Looking only at price. A cheap solution often stores data in a foreign cloud and fails compliance requirements.
- Trusting the word "encrypted". Transport encryption (HTTPS) is not E2E. Ask: is the message stored on the server in plaintext?
- Ignoring management. A platform without RBAC and audit cannot be considered corporate-grade.
- Not planning migration. Plan ahead for moving old chats and contacts, as well as training employees.
Tip: ask the vendor for a pilot project (trial period) and technical documentation. The safest approach is to test the solution with a small department, without real data.
How HAMA handles this
HAMA is a single secured platform for organizations in Uzbekistan (business and government bodies). Against the criteria above:
- E2E encryption: the Signal protocol (X3DH + Double Ratchet), AES-256-GCM for groups, transport over TLS 1.3 only, a local database encrypted with SQLCipher, keys held in the OS secure store.
- Hosting: a secured server in Uzbekistan or on-premise in the organization's infrastructure. Data is stored in Uzbekistan.
- Compliance: preparation for O‘z DSt ISO/IEC 27001:2023 and PP-167 is underway.
- Management: roles and permissions via RBAC, an admin panel, audit.
- Modules: messenger, video conferencing, activity monitoring, time tracking/attendance (FaceID), HR/org structure, helpdesk, remote access — in one platform.
- Client and support: a Windows desktop client (MSI), a local team.