Minimize what the service must know.

The primary device owns an Ed25519 signing key. Every destructive acknowledgement is bound to a server nonce, message identifier, raw SHA-256 hash, vault commit identifier and short expiry.

Mail objects and attachment payloads are encrypted at rest. The master secret is protected through the operating system credential store; durable SQLite settings are required before acknowledgement.

Recovery objects are encrypted to the device X25519 recovery key before they become eligible for short-term storage. Retention metadata never contains message content.

Mail, control plane, public web and backup/recovery layers have separate credentials, logs and network boundaries. Message bodies are excluded from analytics and normal application logs.