The thing nobody explains
Why spam filtering sits before the encryption
Every zero-knowledge mail service runs into the same wall: you cannot scan what you
cannot read. Some solve it by keeping a key. Some solve it by having barely any filtering
and calling that a privacy feature.
We solved it with ordering. Inbound mail is scored at the gateway, in memory, at the
instant it arrives — and only then sealed to your key and written to disk. Nothing scans
ciphertext at rest, because nothing can. The honest caveat is that for a few hundred
milliseconds during scoring, the message exists in memory in the clear. That is true of
every provider that filters spam at all; we would rather state it than let you assume
otherwise.
The full architecture →