Security at SMail

Encrypted email is only as good as who holds the keys and who can send to you. SMail answers both: your keys stay on your devices, and every sender is a verified identity.

End-to-end encryption

Every message, attachment and document is encrypted on your phone or computer before it is sent, with a key that is wrapped to each of the recipient's devices. The server stores ciphertext and envelopes (who, when, how big), nothing it can read. Shared documents and secure links work the same way: the key lives on the devices, or only in the link.

No passwords

There is no SMail password, so none can be phished, leaked or reused. You sign in with a presentation from your TrustChain wallet, signed by your phone's key over a one-time code. Passkeys (WebAuthn, with your fingerprint, face or screen lock) can be added only from a wallet-started session and sign in to that account only. The wallet stays the root: deleting your account, adding badges and recovery still need it.

Verified senders

A member's identity was checked in person by an accredited identity partner on TrustChain, from a government document. SMail knows each wallet only by a long pseudonym made for SMail, and keeps your verified display name; it never receives your ID number or date of birth. Anyone can check a member's accreditation on the public TrustChain explorer.

Mail from outside

Ordinary email, if you let it in, is kept apart: an External tray, an unverified label, links disabled until you open them on purpose, risky attachments held, and DMARC results shown. Block an address or a domain and it is dropped at the gateway. Allow an address and it still only counts when DMARC passed.

Organisations cannot read your mail alone

Escrow is a key made on an officer's device and split among the officers' devices (Shamir sharing). Three officers, or both of two, must act together to unseal, and every unsealing names who asked, why and who took part, in a hash-chained audit that every member in scope can see.

Infrastructure

SMail runs in one hosted location in the European Union (AWS eu-north-1), with signing keys in a hardware-backed key service that private keys never leave. Sessions last twelve hours and end after an hour unused. Code is tested end to end before every release.

Found a problem? Write to [email protected].