Encrypted in transit
Connections to BlackVault Mail use TLS, so mail and sign-ins are protected on the wire.
Security
Security, stated plainly
This page describes how BlackVault Mail protects your mail, and what it does not claim to do, in plain language.
At a glance
How your mail is protected
Encrypted at rest
Message content and attachments are sealed with AES-256-GCM, a widely used authenticated encryption standard, before they are stored.
Isolated by tenant
Each organization’s data is separated at the database level with row-level security, and protected with encryption keys of its own.
Strong sign-in
Passkeys, authenticator-app codes (TOTP) and Argon2id password hashing protect every account.
Authenticated sending
Per-domain DKIM signing and SPF and DMARC alignment make your mail verifiable and your domains harder to spoof.
Audit trail
Security-relevant events are recorded in an audit log so activity can be reviewed.
The journey of a message
Protected from the moment it arrives
Here is what happens to a message, from arrival to reply.
Arrives
Inbound mail is handed to BlackVault Mail over an encrypted, authenticated connection.
Sealed
Message content and attachments are encrypted before they are stored.
Stored in isolation
Data is kept apart from every other organization’s, under that organization’s own keys.
Opened by you
Only after you sign in with a passkey, an authenticator code or a password. Messages are sanitized before they are shown.
Sent as you
Outgoing mail is signed with your domain’s DKIM key and aligned with SPF and DMARC.
Honest limits
What we do and don’t claim
Not end-to-end encrypted. Standard internet email passes through the servers of the sender’s and the recipient’s providers, so it cannot be end-to-end encrypted. BlackVault Mail protects your mail in transit and at rest and controls who can reach it. Between providers, mail is encrypted in transit when the other side supports TLS. We would rather tell you that plainly than imply otherwise.
Your data stays yours
Privacy by design
- No data mining. We don’t scan your mail for advertising, build profiles, or sell or share your data.
- Narrow legal requests. We respond to valid legal process only, and disclose only what the request specifically requires. See legal requests.
- Documentation on request. Security questionnaires and more detailed documentation are available on request. Contact us.
Responsible disclosure
Report a vulnerability
If you believe you have found a security issue in BlackVault Mail, please tell us.
- Email security@blackvaultmail.com. Our security.txt has the same details.
- Include enough detail to reproduce the issue, and what you think the impact is.
- Please give us reasonable time to respond before sharing the issue publicly, and avoid accessing data that isn’t yours.
Questions
Security FAQ
Is BlackVault Mail end-to-end encrypted?
No. Standard internet email passes through the servers of the sender’s and the recipient’s providers, so it cannot be end-to-end encrypted. BlackVault Mail protects your mail in transit and at rest and controls who can reach it. Between providers, mail is encrypted in transit when the other side supports TLS. We would rather say that plainly than imply otherwise.
Do you read or mine my mail?
No. We don’t scan your mail for advertising, build profiles, or sell or share your data.
What sign-in options are available?
You can sign in with a passkey, an authenticator-app code, or a password. Passwords are stored only as Argon2id hashes.
How does BlackVault Mail help with spoofing and deliverability?
Every sending domain uses its own DKIM signature and is aligned with SPF and DMARC. That makes your mail verifiable to receiving servers and makes it harder for others to impersonate your domains.
How do I report a security issue?
Email security@blackvaultmail.com with enough detail to reproduce the issue. See the section below for what to include.
Questions about how we protect your mail?
Ask us anything. Detailed security documentation is available on request.