How Cirrux handles encryption

Cirrux has two products, and they use two different encryption models on purpose. This page explains both, so you know exactly what we can and cannot see.

Cirrux Workspace

Your own connections to Cirrux use TLS: HTTPS for the web apps and API, and TLS for IMAP, SMTP, CalDAV and CardDAV. Mail exchanged with other providers uses opportunistic TLS: we encrypt the connection whenever the other server supports it, and only fall back to an unencrypted connection when it does not.

At rest, message content, attachments and Drive files live in object storage in Frankfurt, Germany, encrypted by Cirrux before they are written:

Two things sit outside this scheme. Message metadata used for search and the mail list (such as subjects, senders and plain-text bodies), calendars and contacts are stored in our managed PostgreSQL database in the same data center, not in object storage under your workspace keys. And when you create a public link to a Drive file, we store a separate decrypted copy so anyone with the link can download it without your keys; that copy is deleted when the link is removed.

Why Workspace mail is not end-to-end encrypted

This is a deliberate trade-off, and we do not plan to change it. End-to-end encryption would mean the server holds nothing but ciphertext, and that rules out the things people actually expect from their mail provider:

• Search across your whole mailbox, fast, from any device, without downloading every message first.
• Spam and malware filtering, which has to inspect a message before it reaches you.
• Server-side filters and rules, which run whether or not you have a client open.
• Standard clients. Apple Mail, Thunderbird and Outlook speak IMAP, not our proprietary crypto. An end-to-end encrypted mailbox only works through apps we control.

There is also a plainer point worth making: email between two providers is not private by design. A message you receive from Gmail was already readable by Google, and one you send to a Gmail user becomes readable by Google the moment it arrives. A provider that encrypts its own storage end to end still cannot change that. If you need genuine end-to-end secrecy for specific messages, use OpenPGP or S/MIME in your mail client, which works over Cirrux like any other IMAP account.

What we do commit to: your mail is never mined, never used to train anything, never sold, and never read by a human at Cirrux outside a support request you have asked us to look into.

Cirrux Backup

Cirrux Backup is a different job: it archives your Gmail so you keep a copy you control. Nothing needs to search or filter it on our side, so it is end-to-end encrypted and your private key never leaves your machine. Even with full access to our servers, an attacker would find only ciphertext.

The encryption flow

Here is what happens when Cirrux backs up an email:

1. Cirrux downloads your email from Gmail
2. The email content is compressed using zlib
3. A unique 256-bit symmetric key and 12-byte nonce are generated
4. The compressed content is encrypted using AES-256-GCM
5. The symmetric key is encrypted (wrapped) using your RSA public key
6. The encrypted email, wrapped key, nonce, and authentication tag are stored on our object storage in Europe (Frankfurt, Germany)
7. The original email and unencrypted symmetric key are immediately discarded from memory

The decryption flow

When you download your emails using the Cirrux Downloader App:

1. The app requests a list of your encrypted emails from Cirrux
2. For each email, it downloads the encrypted content, wrapped symmetric key, nonce, and authentication tag
3. Using your locally stored RSA private key, it unwraps the symmetric key
4. The authentication tag is verified to ensure the data has not been tampered with
5. The symmetric key and nonce are used to decrypt the email content
6. The content is decompressed
7. The decrypted email is saved as a standard .eml file on your machine

Why the hybrid approach

• Performance: AES-256-GCM is fast and efficient for encrypting large amounts of data. Using RSA directly on email content would be significantly slower and has size limitations.
• Blast radius: Each email has its own unique symmetric key and nonce. Even if one key were somehow compromised, only that single email would be affected.
• Zero-knowledge: Since we only store your public key, we can encrypt data for you but never decrypt it. Your private key never touches our servers.
• A common pattern: Encrypting data with a symmetric key and wrapping that key with a public key is how most hybrid encryption schemes, including OpenPGP, work.

At a glance

Related

• Reliability and backups covers where your data lives and how it is backed up.
• Deliverability covers how we keep outgoing mail landing in the inbox.

Questions?

If you have questions about any of this, or want to go deeper on the technical details, email us at help@cirrux.co.