1. Local Key Derivation & Client-Side Sandbox
Foxcolab Mail enforces client-side cryptographic encapsulation. Master passwords do not leave your terminal in plain text. Instead, when you input credentials, our local WebAssembly module uses client-side derivation routines:
- Iterations: 1 pass configuration to optimize mobile constraints.
- Memory: Parallelized 64MB memory arrays client-side.
- Entropy: 32-byte cryptographic random salts are bound to client authentication seals.
The resulting hash is utilized to generate a local decryption seal for the private key envelope. Decrypted private keys exist solely in volatile client memory and are instantly cleared upon closing your browser tab.
2. Data-at-Rest Architecture (Sovereign Storage Rings)
Every message stored in our databases is formatted as an encrypted ciphertext envelope prior to transmission. This guarantees absolute data sovereignty.
Our storage tier utilizes distributed, multi-master cluster rings. Even if server hosts, hard disks, or host administrators are compromised:
- Zero Content Visibility: They only possess binary character fields representing cryptographic payloads.
- Zero Key Exposure: Database administrators cannot access the memory space where users run client-side decryption routines.
- Immutable Block Audit Trail: Every cluster write verifies signature integrity before commit.
3. Transit Protocols & Gateway Sanitization
To eliminate communication intercept and spoofing attempts, our network layers implement:
- Perfect Forward Secrecy (PFS): Ephemeral Diffie-Hellman keys are negotiated for every API gateway socket connection.
- SMTP MTA-STS Enforcement: Our gateways enforce strict TLS-reporting policies, rejecting connections to host destinations that attempt to negotiate unencrypted plain channels.
- Metadata Header Scrubbing: Edge gateways scrub incoming SMTP transaction files to remove originating IP coordinates, localized client client tags, and OS metrics from headers.
4. Audit Trail & Vulnerability Schedule
Our open-source cryptographic components are designed for complete public auditability. We coordinate:
Annual external source code audits performed by independent, recognized digital safety firms. Furthermore, we maintain a continuous, structured bug bounty schedule to identify memory leaks, WASM compilation issues, or cryptographic weaknesses in the pipeline.