Security, in plain terms.
What is encrypted, with what, where the keys live, and what we can and cannot see.
What is encrypted
Every message body (text and HTML) and every attachment is encrypted before it is written to disk, with AES-256-GCM. Message envelopes — sender, recipients, subject, timestamps — are stored in the clear so your inbox can be listed, searched and threaded. Two-factor secrets and provider credentials are encrypted the same way.
Where the keys live
Each firm has its own random data key. It is stored only wrapped by a platform master key that lives outside the database, on the server, with no copy in the application's data store. A copy of the database alone cannot decrypt a single message.
In transit
Your browser talks to the service over TLS (HTTPS, HSTS). Mail leaves and arrives over TLS where the other mail server supports it, and your domain carries SPF, DKIM and DMARC so that mail from you can be trusted and mail pretending to be you can be rejected.
Who can read a message
People in your firm who are signed in, through this application, which decrypts on the way to the screen. Administrators of the platform do not have a mailbox view; access to the servers is logged. This is encryption at rest and in transit, not end-to-end encryption: the service must decrypt to show you a message.
Signing in
Password (12 characters minimum, hashed with a slow algorithm) plus a six-digit authenticator code, for every account, every time. Failed attempts are throttled. Sessions expire after 12 hours. Password resets wipe two-factor so a stolen reset link cannot keep a foothold.
Audit log
Sign-ins, failed sign-ins, every message sent or blocked, every change to domains, mailboxes, people and keys — with the time and address — visible to your firm's administrators under Usage.
Reputation guardrails
Daily limits per mailbox, per domain and per firm; a warm-up ramp for new mailboxes; a burst limit; no duplicate messages to the same address within a day; attachment type and size rules; and a circuit breaker that pauses a domain by itself when bounces or spam complaints rise. These protect your domain and everyone else's.
If something goes wrong
Any firm or the whole platform can be paused in one click. Keys can be rotated. Data for a firm can be exported or destroyed on request, and destroying the firm's key makes its stored messages unreadable at once.
Questions a reviewer would ask that are not answered here: ask, and the answer goes on this page.