No standing access. No casual reading.
Encrypted everywhere it rests, plaintext only briefly in memory while we classify it, no product path for an employee to read your mail, and every key use logged. That's the bar we build to — and we're clear about the one thing we can't offer.
What we can't promise: end-to-end encryption
To classify a message, the service has to read it — and keep doing so while you're offline. So Blockjay must decrypt your mail autonomously, which rules out true end-to-end or zero-knowledge encryption (the only way to get that is to filter on your device, which defeats a hosted filter). We will never describe Blockjay as E2EE or zero-knowledge, because it isn't.
Encryption, end to end of our control.
Encrypted at rest
Message bodies and stored content are encrypted with AES-256-GCM. Raw database, disk, or object-store access yields ciphertext only.
Keys never in the database
Envelope encryption: each user and organization has a data encryption key, wrapped by a master key in a key-management service that logs every use.
Credentials encrypted & never logged
Mailbox passwords and OAuth refresh tokens are encrypted the same way; plaintext exists only transiently in worker memory at connect time.
Encrypted in transit
TLS everywhere — IMAP, POP3, and SMTP run over TLS, as do the internal hops between services.
No standing admin access
There is no admin endpoint that returns message content, by construction. Administrators see operational data only — account health, counts, status.
Data-minimized AI
The uncertain band is classified by our own self-hosted Blockjay model, with Anthropic's models as a fallback. Either way we send only the minimum — sender, a header summary, a short excerpt — and the fallback runs under a zero-retention, no-training arrangement. You can turn it off.
Your mail is walled off three ways.
Isolation is cryptographic first, then enforced again in the database — defense in depth, not a single application check.
Cryptographic
Each user's mail is encrypted under their own key, so one user's key cannot decrypt another's data, even at the storage layer.
Row-level
Every row carries an organization and user id, and PostgreSQL row-level security enforces the boundary in the database — an application bug can't leak across tenants.
Dedicated tiers
Higher-assurance and enterprise tiers can move to schema-per-organization, or a dedicated database and key.
Two-step verification.
Protect sign-in with an authenticator app (TOTP) plus one-time backup codes, set up in your account settings.
What encryption alone can't stop.
A root insider with key-management access is not something encryption alone can prevent. We contain that with least privilege, separation of duties, audited break-glass access, and monitoring — and we'd rather say so than imply a guarantee we can't keep.