Your data stays under your control.
Secure Message runs on a host you own. Messages are encrypted at rest with a key generated there, access is controlled and audited, and nothing in the mail path depends on us.
- Secure messagesEncrypted
- Quarantined mailEncrypted
- eDiscovery archiveEncrypted
- Stored credentials & MFA seedsEncrypted
- Envelope metadata (sender, recipient, subject)Stored in the clear so search works
From the security documentation. No key escrow: back the key up off-host.
Self-hosted, single node, on your network.
- Master key generated at install, never leaves the host
- Encrypted store for secure messages, quarantine and archive
- Admin access MFA, roles and allowlists
- Audit log every change, exportable
Only three ports exposed
25, 80 and 443. Everything else (console, portal, API and database) binds to loopback behind nginx.
No cloud in the mail path
Filtering, encryption and the portal run on the appliance. A hosted AI provider is the only opt-in exception.
Honest about limits
Encryption at rest is not end-to-end encryption, and metadata stays searchable. We document it so you can plan for it.
The specifics, in the open.
Security reviewers want precision. Expand any section, or read the full encryption & access control documentation.
“A security control you have misunderstood is worse than one you know the limits of.” (From our security documentation.)
Encryption at rest, algorithm and key
Message storage uses Fernet: AES-128 in CBC mode with PKCS7 padding, a random 128-bit IV per message, and an HMAC-SHA256 authentication tag over the whole token. It is authenticated encryption, so tampering is detected.
One master key is generated at install, held at /etc/securemail/secret.key with mode 0400, owned by the service account. It never leaves the host and is never transmitted.
What the master key protects
Secure messages (the entire raw message, headers, bodies and attachments), quarantined messages, the eDiscovery archive, stored credentials (relay passwords, AI API keys, LDAP bind password, Entra client secrets, backup passphrase), administrator MFA secrets and API relay passwords. Credential decryption fails closed to empty.
What is not encrypted
Envelope metadata (sender, recipients, subject, client IP, HELO, size and message ID) is stored in the clear in PostgreSQL so search, reporting and the dashboard work. Treat database access as metadata access; retention settings control how long it persists.
Administrator passwords and one-time codes are stored as salted one-way hashes.
Keys, escrow and rotation
There is no key escrow and no key rotation. Back up /etc/securemail/secret.key off-host and treat it as the crown jewels: a database backup without it is unreadable. That's the deliberate trade for a key that never exists anywhere you don't control.
Transport security
Web: TLS 1.2 and 1.3 only, HSTS for one year, plus frame-deny, no-sniff and no-referrer headers. SMTP: STARTTLS inbound and outbound, with policy levels from opportunistic through DANE and full verification. You can require TLS for named domains, and publish MTA-STS and TLS-RPT.
Encrypted backups
Backups use a separate key derived from your passphrase with scrypt, so a backup can be restored to new hardware without moving the master key. Chunked, indexed and terminated archives detect reordering and truncation, and a self-test runs before every backup. Scheduled encrypted backups are a Professional feature.
Administrative access
Three roles: superadmin, operator and a read-only auditor enforced at the request level. TOTP MFA, Microsoft Entra SSO (single-tenant, nonce required, MFA still enforced), CSRF tokens on every form, and an optional network allowlist that also gates the login page.
An application-layer firewall blocks a source IP after five failed password, MFA, SSO or code attempts in fifteen minutes (sixty-minute block by default).
Audit logging
Every successful state-changing request is audited automatically with the administrator, action and submitted values. Secrets are masked before storage. Retained 90 days by default and exportable as CSV with formula injection neutralised.
eDiscovery access is separated from administration
The ordinary admin message viewer never decrypts. Reading archived content needs a separate per-administrator permission that is off for everyone by default (including superadmins), plus re-authentication, and the grant lasts ten minutes. Legal hold exempts messages from retention. eDiscovery is an Enterprise feature.
Recipient access model (Professional portal)
External recipients have no accounts or passwords. Access needs both the link and a one-time code delivered to the original address, so forwarding doesn't transfer access. Message HTML is sanitised and shown in a sandboxed frame.
Clear about compliance.
Not a certification
No email product can be HIPAA certified. Secure Message is built to support safeguards like encryption at rest under your keys, audit logs and access control. Compliance depends on how you configure and operate it.
Not end-to-end encryption
Messages are encrypted at rest on your gateway and protected by TLS in transit. The portal shows decrypted content to the verified recipient in a sandboxed view.
Bring your security questions.
We're happy to walk your reviewers through the architecture, key handling and access model.