Security at enemail

Your email is yours alone.

We built enemail so that even we cannot read your messages. Not because we have to — because it's the only way privacy should work. Here's exactly how.

AES-256 Symmetric encryption

RSA-4096 Key exchange

Zero Knowledge architecture

100% EU Server infrastructure

Architecture

Zero-knowledge — by design

Zero-knowledge means that enemail's servers only ever store ciphertext — encrypted data that is mathematically impossible to read without your private key. Your private key never leaves your device in readable form.

When you log in, your password is used to derive a key locally on your device. That key decrypts your private key locally. The decrypted private key then decrypts your emails — all in your browser or app, never on our servers.

enemail cannot read your emails
We cannot hand over readable content to authorities
A server breach exposes only encrypted data
No employee can access your mailbox

Your device

Encrypted only

enemail server

🔒 Private key never reaches the server

Encryption Standards

Military-grade cryptography. Open standards.

We use only well-established, peer-reviewed algorithms. No proprietary "black box" encryption — everything can be independently verified.

AES-256-GCM

Email content is encrypted with AES-256 in Galois/Counter Mode. GCM provides both confidentiality and authentication — tampered ciphertext is detected and rejected.

Symmetric encryption

RSA-4096

Asymmetric key pairs use 4096-bit RSA. Your public key encrypts the session key; only your private key can decrypt it. Brute-forcing a 4096-bit key is computationally impossible.

Key exchange

bcrypt / Argon2

Your password is never stored. It's processed through Argon2id (memory-hard key derivation) before being used to encrypt your private key. Even with server access, passwords cannot be recovered.

Password security

TLS 1.3

All data in transit is protected with TLS 1.3 — the latest and most secure transport protocol. Older, vulnerable versions (TLS 1.0/1.1, SSL) are disabled entirely.

Transport security

PGP / OpenPGP

Full PGP support for encrypted communication with non-enemail users. Import/export keys, sign messages, and communicate with the global PGP ecosystem.

Interoperability

Forward Secrecy

Each email session uses ephemeral keys. Even if a long-term key is ever compromised in the future, previously encrypted messages remain secure and unreadable.

Session security

Infrastructure

Your data never leaves Europe

enemail runs exclusively on dedicated bare-metal servers by Evolushost located in Frankfurt, Berlin, and Vienna. No shared cloud, no US hyperscalers, no jurisdictional grey areas.

Dedicated hardware means no noisy neighbours, no hypervisor attacks, and no cloud provider able to image your server. Physical access is restricted and monitored 24/7.

Frankfurt, Germany

Berlin, Germany

Vienna, Austria

Austrian jurisdiction · GDPR · No US CLOUD Act exposure

Threat Model

What we protect you against

Being honest about what a security system can and cannot do is part of good security. Here's our threat model.

Protected against

Mass surveillance and bulk data collection
Data breaches — servers hold only ciphertext
enemail employees reading your email
Weak legal requests (our jurisdiction requires strong legal basis)
Email content interception in transit (TLS 1.3)
Password database leaks (passwords are never stored)
Advertising profiling and data monetisation

Limitations to understand

If your device is compromised, your emails can be read (device security is your responsibility)
Email metadata (who you communicate with) requires additional protection
Emails to non-encrypted providers (Gmail, etc.) are delivered unencrypted on their side
A forgotten password means lost access — we cannot recover it
Sophisticated nation-state attackers with physical device access

Found a vulnerability? Tell us.

We take security reports seriously. If you discover a security vulnerability in enemail, please report it responsibly. We commit to acknowledging reports within 48 hours and to working with researchers to resolve issues before public disclosure.

We are building a formal bug bounty programme. In the meantime, please reach out directly.

security@enemail.de

PGP-encrypted reports welcome