seshatsecure file vault
Security you can prove
Your email is some of your most sensitive data. Seshat is built so a single failure never exposes it — and so you can always demonstrate your records are intact.
Lock any file and it's sealed with a passphrase only you know — not even Seshat can open it. Everything else is encrypted and isolated, and is decrypted only to do what you ask — search, preview, or download. We never read your mail, mine it, sell it, or use it to train anything.
Encrypted in transit & at rest
TLS protects your mail on the way in; every message is then sealed with envelope encryption (AES-256-GCM, keys wrapped with RSA) and stored in isolation from everything else.
Byte-exact originals
We keep the original email exactly as it arrived — defensible for audits, e-discovery, and the full 7-year retention window.
Verified before deletion
Every message is hash-checked in the vault before anything is ever removed from your inbox. Nothing is deleted on trust.
Zero Trust access
The vault sits behind an identity gate — it isn't reachable from the public internet, so attackers never even reach the login.
Contained to your account
You only ever see your own files, every request re-checks ownership, and sensitive files can be locked with their own password.
Audited & retained
Every sign-in, download, and deletion is logged. Files auto-expire at 7 years — with a legal hold to freeze anything you must keep.
| Area | What we do |
|---|---|
| Encryption at rest | Every message is envelope-encrypted: a per-message AES-256-GCM key encrypts the .eml, and that key is wrapped with RSA (RSA-OAEP). The vault's private key is held outside the application's web root. |
| Encryption in transit | HTTPS/TLS 1.2+ everywhere, with HSTS and forced HTTPS at the edge. |
| Passphrase-sealed files | Files you lock are sealed with a key only you hold — we cannot decrypt or recover them. |
| Password storage | Passwords are hashed with Argon2id. We never store them in the clear and never see your mailbox password (we hold only revocable access tokens). |
| Authentication | Optional two-factor sign-in (authenticator app or emailed code). Single sign-on with Microsoft and Google. Sign-in is rate-limited. |
| Authorization | Every request is scoped to your account and re-checks ownership; there is no cross-account access path. |
| Network isolation | The administrative console sits behind a Zero Trust access gate. Application and storage credentials are least-privilege and scoped. |
| Storage isolation | Encrypted objects live in a separate object-storage account (Cloudflare R2) reached only with a scoped key; each object is namespaced to its owner. |
| Integrity | Originals are kept byte-exact; a complete vault copy is verified (hash-checked) before any message is removed from a source mailbox. |
| Logging | Sign-ins, downloads, transfers, deletions, and billing events are recorded in an append-only audit log. |
| Content handling | Your mail is decrypted only to do what you ask (display, search, download). We don't mine it, sell it, or train models on it. |
We are an early-stage provider and don't yet hold a formal third-party certification (e.g. SOC 2 / ISO 27001). We're happy to complete a security questionnaire on request — contact [email protected].
.eml files anytime — the copy that no outage can touch.No storage system is infallible, which is exactly why we keep originals byte-exact, verify before deleting, and encourage you to keep your own downloaded copy. Availability commitments are described in our SLA.