How Cirrux handles encryption

Cirrux has two products, and they use two different encryption models on purpose. This page explains both, so you know exactly what we can and cannot see.

Cirrux Workspace (mail, calendar, contacts, Drive) is encrypted in transit and encrypted at rest, with keys held by us. Your mail is readable on our servers, because search, spam filtering and server-side filters need to read it.
Cirrux Backup is end-to-end encrypted. The private key is generated on your machine and never reaches us, so we cannot read your backed-up mail even if we wanted to.

Cirrux Workspace

Everything you send and receive travels over TLS: HTTPS for the web apps and API, TLS for IMAP, SMTP, CalDAV and CardDAV, and opportunistic TLS when we hand your mail to another provider.

At rest, message bodies, attachments, and Drive files live in encrypted object storage in Frankfurt, Germany. We use envelope encryption:

Per-object data keys

Every stored object gets its own 256-bit key and is encrypted with AES-256-GCM, which protects both the confidentiality of the content and its integrity, so tampering is detected on read.

Per-workspace master keys

Each data key is then wrapped with a master key that belongs to your workspace. Raw email, attachments, outbound mail and Drive each have their own master key, so a key is never shared across categories.

Deletion means unreadable

Because content is only reachable through your workspace keys, destroying those keys leaves the stored bytes permanently unreadable. Deleting your account is not just a flag in a database.

Why Workspace mail is not end-to-end encrypted

This is a deliberate trade-off, not a gap we intend to close. End-to-end encryption would mean the server holds nothing but ciphertext, and that rules out the things people actually expect from their mail provider:

Search across your whole mailbox, fast, from any device, without downloading every message first.
Spam and malware filtering, which has to inspect a message before it reaches you.
Server-side filters and rules, which run whether or not you have a client open.
Standard clients. Apple Mail, Thunderbird and Outlook speak IMAP, not our proprietary crypto. An end-to-end encrypted mailbox only works through apps we control.

There is also a plainer point worth making: email between two providers is not private by design. A message you receive from Gmail was already readable by Google, and one you send to a Gmail user becomes readable by Google the moment it arrives. A provider that encrypts its own storage end to end still cannot change that. If you need genuine end-to-end secrecy for specific messages, use OpenPGP or S/MIME in your mail client, which works over Cirrux like any other IMAP account.

What we do commit to: your mail is never mined, never used to train anything, never sold, and never read by a human at Cirrux outside a support request you have asked us to look into.

Cirrux Backup

Cirrux Backup is a different job: it archives your Gmail so you keep a copy you control. Nothing needs to search or filter it on our side, so it is end-to-end encrypted and your private key never leaves your machine. Even with full access to our servers, an attacker would find only ciphertext.

Key generation

The Cirrux Downloader App generates a 2048-bit RSA key pair on your machine. The public key is sent to Cirrux and stored in our database. The private key is saved locally in ~/Cirrux/keys/ with restricted file permissions, and it never leaves your device.

Email encryption

Each email is compressed and then encrypted using AES-256-GCM, a symmetric algorithm that provides both confidentiality and integrity. We generate a unique 256-bit key and 12-byte nonce for each email. GCM mode includes an authentication tag that ensures your data cannot be tampered with.

Key wrapping

The symmetric key used to encrypt each email is then encrypted with your RSA public key. The wrapped key is stored alongside the encrypted email on our storage servers. Only your private key can unwrap it.

The encryption flow

Here is what happens when Cirrux backs up an email:

Cirrux downloads your email from Gmail
The email content is compressed using zlib
A unique 256-bit symmetric key and 12-byte nonce are generated
The compressed content is encrypted using AES-256-GCM
The symmetric key is encrypted (wrapped) using your RSA public key
The encrypted email, wrapped key, nonce, and authentication tag are stored on our object storage in Europe (Frankfurt, Germany)
The original email and unencrypted symmetric key are immediately discarded from memory

The decryption flow

When you download your emails using the Cirrux Downloader App:

The app requests a list of your encrypted emails from Cirrux
For each email, it downloads the encrypted content, wrapped symmetric key, nonce, and authentication tag
Using your locally stored RSA private key, it unwraps the symmetric key
The authentication tag is verified to ensure the data has not been tampered with
The symmetric key and nonce are used to decrypt the email content
The content is decompressed
The decrypted email is saved as a standard .eml file on your machine

Why the hybrid approach

Performance: AES-256-GCM is fast and efficient for encrypting large amounts of data. Using RSA directly on email content would be significantly slower and has size limitations.
Blast radius: Each email has its own unique symmetric key and nonce. Even if one key were somehow compromised, only that single email would be affected.
Zero-knowledge: Since we only store your public key, we can encrypt data for you but never decrypt it. Your private key never touches our servers.
Industry standard: This hybrid pattern is the same approach used by secure messaging apps, password managers, and enterprise security systems worldwide.

At a glance

Data	In transit	At rest	Who holds the key
Workspace mail, calendar, contacts	TLS	AES-256-GCM	Cirrux, per workspace
Drive files	TLS	AES-256-GCM	Cirrux, per workspace
Cirrux Backup archives	TLS	AES-256-GCM, RSA-wrapped	You, on your machine

Reliability and backups covers where your data lives and how it is backed up.
Deliverability covers how we keep outgoing mail landing in the inbox.

Questions?

Security is an ongoing conversation. If you have questions about any of this, or want to go deeper on the technical details, reach out at help@cirrux.co.