Encryption at rest
Planned, not built yet.
The plan: seal every field of a message before it is stored. Today, mail is stored as it arrived.
In short
What is encryption at rest?
Encryption at rest seals stored data, so a copy taken without the key is unreadable. Whoever holds the key can still read it.
How it works
Sealed against a copy, not the server
The server would derive the key, so a stolen database dump would be ciphertext and search would still work.
One rule for what would be sealed
Seal what a person wrote or chose, leave what the machine chose. Timestamps and your domain would stay readable.
Search would still match fragments
Today it reads up to 4,000 characters of each thread's newest message. Sealed, that text would be scanned where the key is held, with no word index on disk.
What you get
In the product today
What is sealed now
Webhook signing secrets, DNS provider tokens and DKIM keys, before they are stored.
Keys kept apart
Each kind of secret has its own derived key, so none opens another.
What protects mail today
The storage provider encrypts its disks. We add no layer of our own.
Good practice
Getting the most out of it
- 01
Use end-to-end for secrets
It works between OpenEmail addresses with published keys, and seals the body from us.
- 02
Keep secrets out of subjects
End-to-end encryption leaves subjects readable, and so does storage today.
- 03
Read the privacy page
It says plainly what the server can read today.
Where it stands
What is not built yet
- Sealed mail
- Bodies, subjects and attachments are stored as they arrived.
- Everything around a message
- Snippets, summaries, notes, contact names and filenames are unsealed too.
Questions
Asked often
Keep going
Works well with
OpenPGP keys made in your browser. Mail you send to another OpenEmail address can be sealed before it leaves the tab, and sealed mail addressed to you opens in the reading pane, decrypted on your machine. The keys are never ours to hand over.
Start
Your domain,
your mail.
Point a domain at OpenEmail and read it in a mailbox built around it. The free plan covers one domain.
