Built to keep your mail yours
An agent with email access is a powerful thing to hand to software. Envolt Mail is designed so that power stays bounded, visible and accountable.
Every customer is isolated
Each organization gets its own encrypted storage, its own keys and its own records. Isolation is enforced by construction, and a customer's data is never reachable from another customer's workspace. We test this on every release by planting unique markers in separate test customers and proving that neither can ever see the other's.
Encrypted at rest, per message
Raw mail and attachments are encrypted with a unique key per message. Those keys are wrapped under a key specific to your organization and bound to where the data is stored, so a copied file is unreadable anywhere else.
Mail content can't command an agent
Prompt injection, where hidden instructions are planted in an email to manipulate an artificial intelligence (AI) agent, is the defining risk of agent mail. In Envolt Mail, message content is always data. Hidden text is removed and counted, and no content can raise an agent's permissions. Every send passes the Seal policy check regardless of what the agent was told.
No standing send rights
Agents never hold credentials to send mail. Each approved message gets a single-use capability that expires quickly and can't be replayed. A kill switch halts every agent, or a single one, instantly.
We are our own first customer, with no shortcuts
The studio that builds Envolt Mail runs its own agents on it through the same public interfaces and protections as any customer. Our staff have no standing access to anyone's mail content, including our own studio's. Support access happens only with your approval, is time-boxed, and is recorded where you can see it.
Your domain, done properly
Agent mail is authenticated with Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC). Our own domains are signed with Domain Name System Security Extensions (DNSSEC). Envolt Mail never takes over the mail exchanger (MX) records your people rely on.
Reporting a vulnerability
Email security@vaultsparkstudios.com or see our security.txt. We read every report.