Sovereign inbox · v0.0.1

Email your provider cannot read. Works like normal mail.

AES-256-GCM encryption happens in your browser before upload. We store ciphertext and HMAC-hashed metadata — not readable bodies, not plaintext addresses. Self-host on Docker/K8s or run managed cloud when you're ready.

Install locally — free tier See what's available
6 specialist modules, one platform
1 free user per verified domain
Client — privileged a8f3… encrypted blob
Paralegal thread k2m9… encrypted blob
Draft — local autosave 30s local save · not plain on server
🔐 Client-side seal · Ed25519 keys · Argon2id login

Product status

What ships today vs. what's next

From docs/website.md §7 · v0.0.1 pre-GA · last verified 2026-07-10

Available 13 capabilities
  • Encrypted email send/receiveCore product path
  • Inbound SMTP relayGo relay :2525; STARTTLS + per-recipient encrypt-on-receipt; RELAY_INBOUND_HMAC_SECRET
  • Mesh send limits (M1)Lite 50/day, paid 500/day; abuse report + admin suspend
  • Admin, audit, recovery—
  • Custom domain TXT verify—
  • TOTP 2FAANOOBOT_TOTP_ENCRYPTION_KEY required in production
  • Self-host (Docker/K8s)—
  • Client + server searchClient body search after unlock; server = metadata filters only
  • Trust Circle org auto-syncSubscribed org → all member emails in Trust Circle
  • Trust Chat (all 3 modes)Local, same-user ciphertext sync, cross-user peer DMs — ENABLE_TRUST_CHAT=true + VITE_ENABLE_TRUST_CHAT=true default
  • AI draft / summarizeENABLE_AI_GATEWAY=true; zero-knowledge contentHash path — no plaintext on /ai routes
  • Python cognitive servicesIntent-planner, constitution P0–P6, principle engine; insight-broker/Milvus = experimental off
Beta 8 items
  • Managed cloud (M2 beta)Paid Team+ only; lapse auto-offboard; enable MANAGED_BETA_ENABLED + VITE_ENABLE_MANAGED_CLOUD + MANAGED_PROVISIONER_LIVE
  • Outbound mail (M3)Per-tenant subdomain, bounce/complaint webhooks, blocklist monitor; ENABLE_OUTBOUND_MAIL until managed GA
  • Native mobile appsProduction source (EAS build required) — Expo in apps/mobile; biometric via expo-local-authentication; .ipa/.apk via eas build
  • Desktop ElectronProduction source (electron-builder required) — shell in apps/desktop; auto-update via electron-updater when ENABLE_DESKTOP_AUTO_UPDATE=true
  • HSM PKCS#11Implemented; prod slot pending — hsmPkcs11.ts, docs/hsm.md; ANOOBOT_HSM_ENABLED=true; software sim forbidden (ALLOW_SOFTWARE_HSM=false)
  • Load test baselinesPending staging — k6 scripts in tests/load/; p95 < 500ms target
  • Enterprise legal docs finalPending counsel — DRAFT in repo
  • External pen test / crypto auditPending — internal automated security gates pass; external signed reports required for enterprise deployment

Optional Off by default — see docs/feature-flags.md

  • IMAP readENABLE_IMAP=true + RELAY_IMAP_SCRAM_PASSWORD; SCRAM-SHA-256
  • WOPI / CollaboraANOOBOT_WOPI_ENABLED=true + WOPI_ACCESS_TOKEN_SECRET; free on all plans when enabled
  • Swarm runtimeENABLE_SWARM_RUNTIME=false in default production profile
Roadmap 3 items
  • Kyber / hybrid TLSIngress TLS in production; ANOOBOT_KYBER_TLS_ENABLED=false
  • SSO SAML/OIDC—
  • Onboarding UI tourWizard script exists

The moment it clicks

Three people.
Same product. Different relief.

Primary wedge: law, journalism, and regulated teams who need privileged mail — plus self-hosters who want keys on their own metal.

01

Subpoena the provider?

They get ciphertext and hashed metadata — not your letter to the client. Warrant canary renews every 15 days; alert if it goes stale.

Law · news · compliance
02

Keys on your hardware

One command install with Docker. Portable ~/anoobot/mail.db. Same binaries whether you self-host or buy managed hosting later.

Self-host · sovereignty
03

Seat number two

Add a paralegal or hire #2 → Team license ($8/user/mo). RBAC, HMAC-chained audit logs, Trust Circle org auto-sync. No inbox migration.

SMB · agencies · firms

What changes in your life

Benefits backed by engineering gates,
not marketing adjectives

Two passwords, two jobs

Account password logs you in (Argon2id hash on server). Encryption passphrase unlocks mail locally — we cannot reset it. Optional duress/decoy passphrase shows an empty inbox under coercion.

$8→$2

Team self-host license, then volume bands to $2/user at 1,001+ seats. Privacy isn't a luxury tier.

AI without plaintext routes

Draft & summarize via zero-knowledge gateway — contentHash only; plaintext fields rejected. Disable with ENABLE_AI_GATEWAY=false.

You

Pick 3-of-5 recovery trustees. Pick Docker or K8s. Toggle IMAP, WOPI/Collabora, legal export. Feature flags document what's on by default.

Auditors get a chain

HMAC-linked audit logs on paid plans — verify with /api/v1/admin/audit-logs/verify. Message bodies stay encrypted.

Honest status: v0.0.1 pre-GA

Core mail, admin, relay, Trust Chat, and AI gateway are available. Managed live AWS needs provisioning flags. SSO, SOC 2, and counsel-final legal docs are roadmap/pending.

Six packages

Drag through the stack →

Gateway, relay, admin, AI, chat, and enterprise ops — each marked Available, Optional, or Roadmap per docs/feature-flags.md.

📬

Secure Inbox

Gateway · Frontend · Encryption

Fastify API + React SPA with WebCrypto. TipTap compose, client body search, server metadata search, TOTP 2FA, custom domain TXT verify.

AvailableLite freeSQLCipher storage
✨

Smart Mail AI

AI gateway · Python cognitive services

Intent planner, constitution P0–P6, principle engine — default on. Draft/summarize without plaintext on /ai routes.

AvailableDefault onZK gateway
👥

Team & Compliance

Admin · Billing · Audit · Recovery

RBAC (user/admin/auditor), Ed25519 license keys, GDPR erasure, warrant canary, trustee recovery ceremonies — from Team plan upward.

2+ usersAvailable3-of-5 Shamir
📮

Mail Delivery

Go SMTP/IMAP relay

Inbound SMTP encrypt-on-receipt with per-recipient Ed25519 keys. Optional self-hosted SMTP relay for internet delivery (your SPF/DKIM). Mesh send limits: lite 50/day, paid 500/day. IMAP optional — ENABLE_IMAP=true.

SMTP availableMesh limits M1Outbound M3 beta
🤝

Trust Chat

Trust Circle · encrypted DMs

Local-only, same-user ciphertext sync, or cross-user peer DMs. Org members auto-sync to Trust Circle on any paid domain.

AvailableDefault onNo server plaintext
🏢

Enterprise Platform

HSM · K8s · DR · Device trust

PKCS#11 HSM adapter shipped (prod slot validation pending). Blue/green deploy, RTO 30m/RPO 5m DR. SSO SAML/OIDC = roadmap.

251+ usersHSM pending slotSSO roadmap

← drag or swipe →

Plans

Pick your size. Same privacy on every tier.

Encryption is never upsold. You pay for seats, admin tools, and hosting — not for the right to lock your mail.

Annual billing is the default. Best per-user rates on Business and Enterprise.

Free forever

Lite

1 person · 1 domain

$0 always
  • Encrypted inbox + TOTP 2FA
  • AI gateway + Trust Chat (default on)
  • @anoobot.com or DNS TXT domain
  • Portable ~/anoobot/mail.db
  • Self-hosted only (self_hosted)
Start free
Self-host or managed

Team

2–25 people

$8 /user · mo (annual)
  • Admin · auditor roles + seat limits
  • HMAC-chained audit logs
  • Trust Circle org auto-sync
  • Managed hosting +$4/user — anoobot_hosted or byo_cloud
Grow your team
Best for growing orgs
Volume pricing

Business

26–250 people

$6 /user · mo (51–100 band)
  • GDPR erasure + Prometheus/Grafana
  • Legal export path (opt-in flag)
  • Python cognitive services on-prem
  • Managed hosting +$4/user
Talk to sales
At scale

Enterprise

251+ people

$3 /user · mo (501–1k band)
  • PKCS#11 HSM adapter (slot validation pending)
  • 99.99% SLA add-on from $500/mo
  • Device trust mesh · multi-domain
  • Custom managed contract
Contact enterprise

How volume bands work

Business and Enterprise price per user drops as your org grows. Annual billing is the default.

26–50 users$7
51–100$6
101–250$5
251–500$4
501–1,000$3
1,001+$2

Team plan: monthly billing available at +20% when enabled.

Rough cost vs. what you give up

Provider Per user Privacy model
Gmail Workspace ~$6+ Readable on provider servers
Proton Mail ~$4–8 Private, no self-host audit trail
anoobot Team $8 Zero-knowledge · your server · full audit
anoobot Business $6 Mid-market volume · sovereignty · GDPR path

Deployment

Three ways to run anoobot

Same encrypted mail stack everywhere — who operates the servers is the difference. Free tier is self-hosted only; managed options require paid Team+.

01

Self-hosted

self_hosted — You install, patch, and operate the stack. Works on your VPS, on-prem hardware, or your own AWS/GCP/Azure account. License fee only; no hosting surcharge.

Free tier · default · you operate
02

anoobot hosted

anoobot_hosted — Anoobot provisions and runs your per-tenant EKS cluster on Anoobot-managed AWS. Paid Team+ only. License + $4/user/mo hosting (M2 beta).

Managed cloud · no DevOps
03

BYO cloud

byo_cloud — Your AWS account (cross-account role), but Anoobot still provisions and manages the tenant stack via Terraform. Paid Team+ only. License + $4/user/mo.

Managed · your cloud account

Quick rule: If you run install.sh, K8s, secrets, and upgrades → self-hosted. If Anoobot provisions EKS and runs lapse/offboard crons → managed (anoobot_hosted or byo_cloud). Hosting on your cloud without Anoobot operating it is still self-hosted.

Email your clients can't subpoena from us —
because we never had it.

In your hands

  • Encryption passphrase — client only
  • Self-host Docker/K8s or managed later
  • 3-of-5 trustee recovery (paid orgs)
  • Auto Organizer rules in browser only
  • Export portable encrypted mail.db

Off the table

  • Plaintext bodies on our disks
  • Your encryption passphrase (no reset)
  • Plaintext addresses in PostgreSQL
  • Full-text body search on server
  • Vendor master key or training on your mail

FAQ

Quick answers

From the repo root: bash scripts/install.sh (or pnpm install:local). Needs Node 20+, pnpm 9+, Docker. Then validate with bash scripts/validate-install.sh and open http://localhost:5173.
Yes — one user per verified custom domain (or username@anoobot.com). Pay when you add user #2 or need org admin, audit, and license enforcement.
Account password logs you in (server stores Argon2id hash). Encryption passphrase unlocks mail in your browser — we cannot recover it. Paid orgs use trustee ceremonies (default 3-of-5 Shamir).
AI draft/summarize is on by default but uses a zero-knowledge gateway — contentHash references only; plaintext is rejected. Principle engine screens outputs. Turn off with ENABLE_AI_GATEWAY=false.
Self-hosted (self_hosted): you operate the stack — on-prem or your cloud account. anoobot hosted (anoobot_hosted): Anoobot runs EKS on its AWS (+$4/user, Team+). BYO cloud (byo_cloud): your AWS account, Anoobot still provisions/manages the tenant (+$4/user, Team+). Free tier is self-hosted only. See #deployment on this page.
No. @anoobot.com is an identity/directory address on the mesh — not centralized outbound SMTP. Mesh send limits (lite 50/day, paid 500/day) and account suspension apply to abuse. See Deliverability plan.
M2 beta: paid Team+ only, lapse auto-offboard. Live AWS needs MANAGED_BETA_ENABLED + VITE_ENABLE_MANAGED_CLOUD + MANAGED_PROVISIONER_LIVE=true. Self-host is fully available today.
Responsive web works now. Native iOS/Android shells are production source (Expo) — store binaries require eas build. Desktop Electron apps likewise need electron-builder.
No — proprietary (UNLICENSED manifests). You can self-host with a valid license key. Security issues: security@anoobot.com.
14-day grace, then send/receive pauses. Encrypted data remains for export. Renew or paste a new Ed25519-signed license key in Admin.
Terms, Privacy Policy, and DPA in repo are draft until counsel sign-off. Enterprise DPAs: legal@anoobot.com. This site is not legal advice.

Technical documentation

Install, ops, and engineering guides

Fourteen technical docs from docs/ as HTML. User guides, product overview, business model, and legal drafts stay in markdown only.

Open technical docs hub

Setup & development

Installationinstall.md Developer guidedeveloper-guide.md Feature flagsfeature-flags.md Desktop appdesktop-app-status.md

Operations

Admin guideadmin-guide.md Ops runbookops-runbook.md Disaster recoverydisaster-recovery.md Production readinessproduction-readiness-checklist.md

Email & deliverability

Deliverability planproduct-plan-email-deliverability.md Outbound mail GAoutbound-mail-ga.md Self-hosted SMTPself-hosted-smtp-relay.md Managed cloud betamanaged-cloud-beta.md

Security & compliance

GDPR compliancecompliance-gdpr.md HSM / PKCS#11hsm.md

Desktop app

Download anoobot for your computer

Electron client for macOS, Windows, and Ubuntu. Connects to your anoobot gateway — does not include the full server stack. Latest release: v1.0.0

macOS .dmg disk image Windows Portable .exe Ubuntu / Debian .deb package

Installers served from Cloudflare R2 at download.anoobot.com/desktop. Unsigned until code signing is configured.

Run anoobot locally

One install script starts Docker infra, migrates the DB, builds, and opens the SPA. No sales call for the free tier.

Read install guide bash scripts/install.sh → bash scripts/validate-install.sh → http://localhost:5173