Zero-knowledge architecture: server only sees ciphertext
Every message stored in your SealedMail mailbox is encrypted with your X25519 public key the moment it reaches our servers. The corresponding private key never left your device. Concretely: at sign-up, your browser or local client locally generates a Curve25519 key pair (X25519 for encryption + Ed25519 for signing). The private key is immediately encrypted by AES-256-GCM with a key derived from your passphrase via Argon2id (OWASP 2024 params: 64 MB, 3 iterations, 4 parallel threads). The server receives only your public key and the encrypted version of your private key, which it cannot decrypt since it does not know your passphrase. This zero-knowledge architecture guarantees that even a Luxgap administrator with root server access cannot read your mailbox.
Incoming mail: encrypted on receipt, never stored in plaintext
When an external correspondent writes to you (from Gmail, Outlook 365, any standard SMTP server), the message logically arrives in plaintext on our incoming SMTP relay. We immediately encrypt it with your public key before persisting it to disk. The plaintext window lasts a few milliseconds in RAM, outside any snapshot, log or backup. The stored message is permanently unreadable by anyone but you. No plaintext archive window, no server-side content indexing. Search works via a server-side encrypted index (Encrypted Search Index architecture, ProtonMail-style) or client-side for mailboxes under 2 GB.
Outgoing mail: Ed25519-signed, encrypted if recipient has a key
When you send an email, your local SealedMail client (web or Outlook Bridge) encrypts the content with the recipient's public key if known: another SealedMail user, contact with OpenPGP key published on WKD servers, or established Autocrypt exchange. Otherwise, the email leaves in plaintext to the recipient (with an orange visual warning in the interface). In all cases, your Ed25519 signature is attached: the recipient can verify the email truly comes from you and has not been tampered with. For recurring exchanges with an external correspondent (your lawyer, your private banker), we offer a free SealedMail Companion invitation so they generate their own key pair and the conversation is end-to-end encrypted in both directions.
Works with your usual Outlook, via SealedMail Bridge
No question of asking a CEO to change their mail client. We provide SealedMail Bridge, a light program running in the background on your machine (Windows, macOS, Linux). It exposes a local IMAP/SMTP mailbox on 127.0.0.1, decrypts your messages on the fly for Outlook, and encrypts your sends before transmission to the server. You configure Outlook once (IMAP + SMTP account on localhost), and everything then works exactly as before: keyboard shortcuts, sorting rules, signatures, shared calendar, search, folders, archives. No functional loss. No habit change. Passphrase is requested at Bridge startup and stays in encrypted memory during the session (never persisted to disk). Also available as HTTPS web client for travel and iOS/Android mobile app.
Recovery in case of passphrase loss: your choice
Zero-knowledge architecture has a downside: if you lose your passphrase, nobody can recover your mailbox, not even Luxgap. For executives who want to guarantee continuity, we offer 3 optional mechanisms you activate or not in full awareness: (1) Paper recovery kit printed at sign-up: 24 BIP-39 words stored in your physical or notarial safe; (2) Shamir 3-of-5 key sharing: 5 trusted persons each receive a fragment, 3 are needed to reconstitute; (3) Board delegation with signed quorum: 2 directors out of 3 can authorise regeneration in case of incapacity. None of these mechanisms is activated by default. If you want no legal backdoor, you keep absolute responsibility for your passphrase.
Anti-coercion: forced opening detectable
For executives exposed to pressures (litigation, divorce, hostile negotiation, judicial control), SealedMail offers a decoy passphrase distinct from your real passphrase. If you are forced to open your mailbox in front of a third party, you enter the decoy passphrase: it decrypts a parallel side mailbox containing only innocuous emails you have prepared (administrative correspondence, invoices). Your real mailbox remains inaccessible and invisible. No server-side trace distinguishes a decoy opening from a normal one. Mechanism inspired by TrueCrypt and VeraCrypt plausible deniability, validated by our security engineering team.
Custom address @yourcompany.com or @sealed.lu
You use your existing corporate domain (pierre.martin@yourcompany.com) by pointing MX records to our SealedMail Luxembourg servers. Zero-downtime migration from Microsoft 365 or Google Workspace: we first sync your history to SealedMail (encrypted on-the-fly during migration), then switch MX. External correspondents continue writing to your usual address. Your non-executive colleagues can keep using Microsoft 365 on the same domain, only sealed mailboxes route through SealedMail. Alternative for fast creation: you@sealed.lu addresses with optional custom subdomain (you@private.yourcompany.com).
Encrypted attachments, up to 500 MB per message
Attachments are encrypted with the same key as the message body. No 25 MB limit like Outlook: you send up to 500 MB per message, useful for M&A dossiers, audit reports, committee videos. If the recipient is another SealedMail user, direct encrypted transmission. If the recipient is external, the heavy attachment is replaced by a secure link to a single-use download (expires after opening or 7 days), with password transmitted via separate channel.
Calendar, contacts, distribution lists: all encrypted too
If only emails were encrypted, your calendar would reveal your meetings with your investment banker or M&A advisor. And your contacts would reveal your strategic address book. SealedMail encrypts everything: calendar events (subject, attendees, location, notes), contact entries (name, phone, address, notes), private distribution lists. CalDAV/CardDAV compatible via the local Bridge, so you keep Apple Calendar, Outlook, Google Calendar as visual client. E2EE multi-device sync between your devices (work laptop, personal iPhone, travel tablet) without anything being readable server-side.
Self-destruction and scheduled message expiry
At send time, you can schedule message expiry: 24 hours, 7 days, 30 days, custom date. After this delay, the message disappears simultaneously from your sent folder, the recipient's mailbox (if SealedMail user) and the server. Useful for ongoing negotiations, price indications, temporary commercial positions. The message leaves no exploitable trace once expired. For external recipients, encrypted content is rendered inaccessible but the envelope (sender, subject, date) remains visible in their mail client.
Luxembourg hosting, EuroPriSe certification in progress
Physical servers at two Tier IV Luxembourg datacenters (LuxConnect DC1 and DC2, geographic redundancy). No replicas outside EU, no US hyperscaler in the chain. GDPR, NIS 2 (important entity, digital services sector), Luxembourg 1 August 2018 law compliance. EuroPriSe certification targeted for 2026. Annual audit by independent firm with public report. Bridge and protocol source code published open source (community review) ; only server components remain proprietary (pricing logic, anti-spam).
Authority requests: total transparency, but nothing to hand over
In case of valid Luxembourg judicial request (rogatory commission, search warrant signed by an investigating judge), Luxgap is legally required to respond. But we can only hand over what we have: encrypted blobs. Without your passphrase, they are mathematically unexploitable. We publish a biannual transparency report (number of requests received, jurisdiction of origin, action taken) on the ProtonMail model. No non-EU request is honoured (no FBI, no US subpoena: we are a Luxembourg entity with no US presence).
