Privacy architecture

A design you can inspect, not a slogan.

← Back to the Learn hub

Here is where your Mail, Calendar, Docs, and Notes content actually goes, described plainly, with the boundaries of what Chrysaor can and cannot see.

Architecture preview — not a security certification.

The data path

Three places your content can be, and what happens in each one.

Your device

  • Generates your encryption keys.
  • Encrypts content before it ever leaves the device.
  • Decrypts content only for reading, on an authorized device.
Explain this

Your device is where readable Mail, Calendar, Docs, and Notes content exists. Keys are generated locally and are not designed to be sent to Chrysaor’s backend.

Your storage

  • Holds encrypted blobs only, when sync is enabled.
  • Can be a self-hosted WebDAV server, self-hosted storage, or a connected encrypted provider.
  • You can see exactly which location is connected at any time.
Explain this

Sync is optional. If you enable it, only encrypted objects travel to the storage location you choose. Chrysaor does not send long-lived storage credentials or plaintext content to its own backend.

Chrysaor services

  • Handles short-lived email verification.
  • Handles essential abuse protection and security events.
  • Is not built to hold readable workspace content.
Explain this

We do not say “we store nothing.” Operational data such as abuse controls, consent records, and security events is distinct from your Mail, Calendar, Docs, and Notes content, and is described in the Privacy Notice.

Three plain-language facts

Your device handles readable content.

Sync belongs to you.

We are building the service so that your content remains under your control.

Why we don’t say certain things yet

We use the phrase “designed to keep your content under your control” rather than “end-to-end encrypted,” “zero-access,” “never stored on our end,” or “no logs,” because those stronger claims are only accurate after their precise implementation, threat model, logging configuration, and a security review have been verified.

We also never say “we store nothing.” Operational data, such as abuse controls, consent records, and security events, is necessary to run the service responsibly and is kept separate from your workspace content.

We do not fabricate audit reports, encryption certifications, compliance badges, user counts, awards, testimonials, or press logos.

Privacy FAQ

Content is decrypted only on an authorized device you control, using keys generated on that device.

It is a configuration-driven label. In this preview build it reads “Architecture preview — not a security certification,” because no external audit has taken place yet.

The address you provide is processed only long enough to deliver and validate a short-lived code. It is not used for advertising, profiling, or mailing lists without a separate opt-in.

Yes, the full draft is on the Privacy Notice page.

Ready to see it in your own workspace?

Create a free workspace