You can check that we
run the public code
A middleman only helps if it’s more trustworthy than what it replaces. So the code is open, and the running service proves which build it’s running.
Running now matches the public codechecked 14 seconds ago, from your browser
Public build
7f3a9d04be12c7a85e61f0d2b9437ac6e8150fd3a2c46b79d1e08f35ab6c72d49e03b18f6ca4d7250be9f1c38a7dc91e- Source
- Release v1.4.2, commit a41f9c2
- Rebuilt by
- 3 independent builders, identical result
- Logged
- 2 March, 7 days before going live
=
Running now
7f3a9d04be12c7a85e61f0d2b9437ac6e8150fd3a2c46b79d1e08f35ab6c72d49e03b18f6ca4d7250be9f1c38a7dc91e- Signed by
- AWS Nitro attestation, chain valid
- Connection
- TLS key bound to this attestation
- Debug mode
- Off
Rebuild the public code and you get the same fingerprint. The running service signs its own.
What this proves
- The service runs an image built from this public code
- Your stored data can only be decrypted by approved builds
- Every approved build is listed publicly, before it goes live
What this doesn’t prove
- That the public code has no bugs or hidden flaws
- That AWS and its hardware behave as documented
- What an app does with mail after receiving it
- That Google or Microsoft can’t see mail they host
- That traffic patterns are hidden from us
What we keep, and for how long
Mail passes through rather than piling up. No third-party model reads it, and it isn’t used to train anything.
| Data | Where | Kept for |
|---|---|---|
| Mail fetched through an account connection | Memory only, inside the enclave | Not stored |
| Mail received by forwarding | Object storage, under your key | Until delivered, or a short limit |
| Mailbox tokens | Database, under your key | Until you disconnect |
| Rules and access settings | Database, under your key | Until you delete them |
| Receipts | Database, under your key, hash chained | You decide, with a default limit |
Why a web page isn’t enough
A browser can’t confirm the page it just loaded came from the verified service. The command checks the connection itself, and rogue certificates would show up in public logs.
$ permaily verify app.permaily.com
Try to break it
We publish the trust model and invite people to attack it. If you find something, tell us, and we’ll credit you in the release log.
See it on your own mail
Connect a mailbox and read the preview. Nothing is shared yet.