Docs › Security model

What the server can and cannot read.

A plain statement of the read boundary on a stored message. Two short tables: what the server sees to do its job, and what stays sealed because the server does not have the key.

The shape of the boundary

Every message on the server is stored as opaque ciphertext keyed to the account that owns it. The decryption key never leaves the browser; the server holds the bytes but does not have the key to open them. What the server can read on a stored message is the routing metadata any mail system needs to deliver and list mail — nothing in the body, the subject, or any attachment.

What the server sees (routing metadata)

Field	Why the server sees it
Account the mail belongs to	The server has to look the row up by it.
Sender address	Required for per-recipient junk and block rules, and for the SMTP Reply-To on outbound replies.
Recipient addresses	Required to deliver and list mail; stored in routing columns alongside the sealed envelope.
Arrival time	Unix-second stamp; required for the inbox ordering and for thread grouping.
Folder, flags, unread state	The user-facing UI state the inbox needs to render correctly (starred, archived, junked, trashed, …).
Envelope byte length	The length of the sealed envelope; the same length leak any ciphertext-only mail system carries.
SMTP threading id	The In-Reply-To link that keeps a thread grouped; not message content.

What the server does not see (sealed fields)

Field	Why the server cannot read it
Plaintext body	The body is sealed before it leaves your browser; the server holds the bytes but does not have the key.
Plaintext subject	The subject is sealed alongside the body. The server treats the value as opaque bytes.
Attachment bytes	Attachments are sealed when you attach them; the download path hands the sealed bytes back to your browser, which opens them locally.
Decryption key	The key is derived in your browser from your password; it never leaves the device that derived it.
Account password	The password is checked at sign-in on my.netquirk.com and is never reused by xail.me.

What this means in practice

The mail server can deliver and list your mail but cannot read the words in any of it. A leak of the stored row gives an attacker routing metadata and an opaque envelope.
Your stored mail is only readable on a device that can derive the key from your password. A forgotten password on a fresh device means the stored mail cannot be opened.
The operator of xail.me cannot recover the plaintext of a stored message for you. Plan for a password manager the same way you would for any other account.