Help
Every mailbox Vellumail hosts is encrypted at rest by default, with the option to go further on a per-mailbox basis.
Message bodies are encrypted in the database using AES-256-GCM. Each mailbox has its own data key, itself wrapped by a master key held on our infrastructure - meaning a stolen database dump alone is not enough to read any mail, but an administrator can still reset a forgotten password.
A mailbox can opt into zero-knowledge mode, which changes who holds the key: instead of our master key, the mailbox's private key is wrapped by its own password and a one-time recovery key generated at enrollment. From that point on, only the account holder - with their password or their recovery key - can unlock it.
This is one-way and deliberate: because there's no administrator override, losing both the password and the recovery key means that mail is unrecoverable. A recovery path we could always use ourselves would be a backdoor by another name, so Vellumail doesn't keep one.
Zero-knowledge mailboxes can't be used as shared mailboxes, since a shared mailbox's contents need to be unwrapped by more than one account.
Contact support to enable zero-knowledge mode on a specific mailbox - this is a one-way change per mailbox, so it's worth confirming with whoever uses that mailbox first.