Security
mutande is built so your devices encrypt and decrypt mail. The cloud hub is a blind courier.
Promises
- Private keys stay on your device (macOS Keychain for the Mac app).
- Handoff content is end-to-end encrypted before it leaves the machine.
- The hub stores ciphertext and routing metadata — not readable message bodies.
- Large files are encrypted before upload; object storage never sees plaintext.
Building blocks (not custom crypto)
Content seal uses ChaCha20-Poly1305 ; per-device key wraps use X25519 / NaCl crypto_box . Details and how to verify contacts: encryption · safety numbers.
What this is not
- Not a guarantee against a compromised device or AI host.
- Not hub-side DLP / “guardrails” — send policy lives in Cursor / Claude / ChatGPT allow lists.
- Not open-inbox email; orgs are invite-only.
- Not a published third-party audit (yet) — trust rests on standard primitives + on-device keys.