01
Subpoena the provider?
They get ciphertext and hashed metadata — not your letter to the client. Warrant canary renews every 15 days; alert if it goes stale.
Law · news · complianceSovereign inbox · v0.0.1
AES-256-GCM encryption happens in your browser before upload. We store ciphertext and HMAC-hashed metadata — not readable bodies, not plaintext addresses. Self-host on Docker/K8s or run managed cloud when you're ready.
Product status
From docs/website.md §7 · v0.0.1 pre-GA
RELAY_INBOUND_HMAC_SECRETANOOBOT_TOTP_ENCRYPTION_KEY required in productionENABLE_TRUST_CHAT=true + VITE_ENABLE_TRUST_CHAT=true defaultENABLE_AI_GATEWAY=true; zero-knowledge contentHash path — no plaintext on /ai routesMANAGED_BETA_ENABLED + VITE_ENABLE_MANAGED_CLOUD + MANAGED_PROVISIONER_LIVEENABLE_OUTBOUND_MAIL until managed GAapps/mobile; biometric via expo-local-authentication; .ipa/.apk via eas buildelectron-builder required) — shell in apps/desktop; auto-update via electron-updater when ENABLE_DESKTOP_AUTO_UPDATE=truehsmPkcs11.ts, docs/hsm.md; ANOOBOT_HSM_ENABLED=true; software sim forbidden (ALLOW_SOFTWARE_HSM=false)tests/load/; p95 < 500ms targetOptional Off by default — see docs/feature-flags.md
ENABLE_IMAP=true + RELAY_IMAP_SCRAM_PASSWORD; SCRAM-SHA-256ANOOBOT_WOPI_ENABLED=true + WOPI_ACCESS_TOKEN_SECRET; free on all plans when enabledENABLE_SWARM_RUNTIME=false in default production profileANOOBOT_KYBER_TLS_ENABLED=falseThe moment it clicks
Primary wedge: law, journalism, and regulated teams who need privileged mail — plus self-hosters who want keys on their own metal.
They get ciphertext and hashed metadata — not your letter to the client. Warrant canary renews every 15 days; alert if it goes stale.
Law · news · complianceOne command install with Docker. Portable ~/anoobot/mail.db. Same binaries whether you self-host or buy managed hosting later.
Add a paralegal or hire #2 → Team license ($5/user/mo). RBAC, HMAC-chained audit logs, Trust Circle org auto-sync. No inbox migration.
SMB · agencies · firmsWhat changes in your life
Account password logs you in (Argon2id hash on server). Encryption passphrase unlocks mail locally — we cannot reset it. Optional duress/decoy passphrase shows an empty inbox under coercion.
Team, Business, and Enterprise — three clear paid bands. Privacy isn't a luxury tier.
Draft & summarize via zero-knowledge gateway — contentHash only; plaintext fields rejected. Disable with ENABLE_AI_GATEWAY=false.
Pick 3-of-5 recovery trustees. Pick Docker or K8s. Toggle IMAP, WOPI/Collabora, legal export. Feature flags document what's on by default.
HMAC-linked audit logs on paid plans — verify with /api/v1/admin/audit-logs/verify. Message bodies stay encrypted.
Core mail, admin, relay, Trust Chat, and AI gateway are available. Managed live AWS needs provisioning flags. SSO, SOC 2, and counsel-final legal docs are roadmap/pending.
Six packages
Gateway, relay, admin, AI, chat, and enterprise ops — each marked Available, Optional, or Roadmap per docs/feature-flags.md.
Gateway · Frontend · Encryption
Fastify API + React SPA with WebCrypto. TipTap compose, client body search, server metadata search, TOTP 2FA, custom domain TXT verify.
AI gateway · Python cognitive services
Intent planner, constitution P0–P6, principle engine — default on. Draft/summarize without plaintext on /ai routes.
Admin · Billing · Audit · Recovery
RBAC (user/admin/auditor), Ed25519 license keys, GDPR erasure, warrant canary, trustee recovery ceremonies — from Team plan upward.
Go SMTP/IMAP relay
Inbound SMTP encrypt-on-receipt with per-recipient Ed25519 keys. Optional self-hosted SMTP relay for internet delivery (your SPF/DKIM). Mesh send limits: Free 50/day, paid 500/day. IMAP optional — ENABLE_IMAP=true.
Trust Circle · encrypted DMs
Local-only, same-user ciphertext sync, or cross-user peer DMs. Org members auto-sync to Trust Circle on any paid domain.
HSM · K8s · DR · Device trust
PKCS#11 HSM adapter shipped (prod slot validation pending). Blue/green deploy, RTO 30m/RPO 5m DR. SSO SAML/OIDC = roadmap.
← drag or swipe →
Plans
Encryption is never upsold. You pay for seats, admin tools, and hosting — not for the right to lock your mail.
Annual billing is the default. Team, Business, and Enterprise each have one clear per-user rate.
Monthly adds +20% and is available on Team only. Business and Enterprise stay annual.
1 person · 1 domain
~/anoobot/mail.dbself_hosted)2–100 people
anoobot_hosted or byo_cloud101–500 people
501+ people
Three paid plans — no nested micro-bands. Annual billing is the default.
Team plan: monthly billing available at +20% when enabled ($6/user/mo).
Switch to annual for Business and Enterprise.
Deployment
Same encrypted mail stack everywhere — who operates the servers is the difference. Free tier is self-hosted only; managed options require any paid plan.
self_hosted — You install, patch, and operate the stack. Works on your VPS, on-prem hardware, or your own AWS/GCP/Azure account. License fee only; no hosting surcharge.
anoobot_hosted — Anoobot provisions and runs your per-tenant EKS cluster on Anoobot-managed AWS. Any paid plan. License + $4/user/mo hosting (M2 beta).
byo_cloud — Your AWS account (cross-account role), but Anoobot still provisions and manages the tenant stack via Terraform. Any paid plan. License + $4/user/mo.
Quick rule: If you run install.sh, K8s, secrets, and upgrades → self-hosted.
If Anoobot provisions EKS and runs lapse/offboard crons → managed (anoobot_hosted or byo_cloud).
Hosting on your cloud without Anoobot operating it is still self-hosted.
Email your clients can't subpoena from us —
because we never had it.
mail.dbFAQ
Install anoobot.command (Mac) or Install anoobot.bat (Windows). Your browser opens when setup finishes.username@anoobot.com). Pay when you add user #2 or need org admin, audit, and license enforcement.contentHash references only; plaintext is rejected. Principle engine screens outputs. Turn off with ENABLE_AI_GATEWAY=false.self_hosted): you operate the stack — on-prem or your cloud account. anoobot hosted (anoobot_hosted): Anoobot runs EKS on its AWS (+$4/user, any paid plan). BYO cloud (byo_cloud): your AWS account, Anoobot still provisions/manages the tenant (+$4/user, any paid plan). Free tier is self-hosted only. See #deployment on this page.@anoobot.com is an identity/directory address on the mesh — not centralized outbound SMTP. Mesh send limits (Free 50/day, paid 500/day) and account suspension apply to abuse. See Deliverability plan.MANAGED_BETA_ENABLED + VITE_ENABLE_MANAGED_CLOUD + MANAGED_PROVISIONER_LIVE=true. Self-host is fully available today.eas build. Desktop Electron apps likewise need electron-builder.UNLICENSED manifests). You can self-host with a valid license key. Security issues: security@anoobot.com.Technical documentation
Fifteen technical docs from docs/ as HTML. User guides, product overview, business model, and legal drafts stay in markdown only.
Desktop app
Electron client for macOS, Windows, and Ubuntu. Connects to your anoobot gateway — does not include the full server stack. Latest release: v0.0.1
Installers served from Cloudflare R2 at
download.anoobot.com/desktop. Unsigned until code signing is configured.
Download the self-host starter pack — three double-click installers plus a short PDF. Unzip into your anoobot folder (must include scripts/install.sh). Install Docker Desktop first; the installer opens your browser when ready.
Hosted at download.anoobot.com/self-host · Mac: Install anoobot.command · Windows: Install anoobot.bat