# Natrium Mail - Complete System Documentation > Sovereign, zero-knowledge, end-to-end encrypted email platform engineered by Natrium Technologies Inc. --- ## 1. Company & Platform Overview - **Name:** Natrium Technologies Inc. - **Canonical URL:** https://natrium.sh - **Mail Relays:** mail.natrium.sh (Direct MX Delivery with 2048-bit RSA DKIM) - **Contact:** support@natrium.sh | security@natrium.sh | legal@natrium.sh | abuse@natrium.sh - **Mission:** Providing mathematically verifiable sovereign communication privacy without corporate surveillance, behavioral tracking, phone number verification, or data monetization. --- ## 2. Cryptographic & Security Architecture ### 2.1 Core Primitives - **Symmetric Message & Vault Encryption:** AES-256-GCM with unique 96-bit initialization vectors and 128-bit authentication tags. - **Key Derivation:** High-cost `scrypt` (and Argon2id support) deriving vault encryption keys on the user's device. - **Hardware Authentication:** FIDO2 / WebAuthn Passkeys (YubiKey, Touch ID, Windows Hello) and RFC 6238 TOTP Two-Factor Authentication. - **Session Integrity:** HMAC-SHA256 signed session tokens with strict origin and CSRF enforcement. - **Outbound Mail Authenticity:** Direct DNS MX resolution with automated 2048-bit RSA DKIM signing, strict SPF (`-all`), and DMARC quarantine/reject enforcement. - **Transport Layer:** TLS 1.3 with HSTS preload and X25519 hybrid key exchange. ### 2.2 Zero-Knowledge Custody & Cryptographic Shredding Private keys and vault secrets are sealed with the user's passphrase and hardware passkey (WebAuthn). Natrium servers only store AES-256-GCM ciphertext envelopes (`.enc` blobs). Account deletion or administrative shredding requires hardware passkey (or emergency master key) verification and performs irreversible cryptographic erasure of all messages, attachments, and keys. ### 2.3 Pre-Vault Attachment Detonation Sandbox All incoming and outgoing file attachments are screened prior to encrypted vault storage using VirusTotal (70+ antivirus engines) and Hybrid Analysis Falcon Sandbox behavioral detonation to neutralize malware, trojans, and zero-day payloads. --- ## 3. Public Pages & Legal Repository - [Webmail & Account Portal](https://natrium.sh/): Main encrypted webmail client, account registration, and sign-in. - [About Natrium](https://natrium.sh/about): Mission, sovereignty principles, and engineering overview. - [Security Architecture](https://natrium.sh/security): Technical breakdown of AES-256-GCM encryption, FIDO2 passkeys, and sandbox screening. - [Natrium vs Proton Mail](https://natrium.sh/compare): Feature, cryptographic, and privacy comparison matrix. - [Contact & SecOps](https://natrium.sh/contact): Support, security vulnerability reporting, and abuse desk. - [Privacy Policy](https://natrium.sh/privacy): Zero-knowledge data governance, GDPR/CCPA rights, and minimal retention policy. - [Terms of Service](https://natrium.sh/terms): Platform usage terms, SLA commitments, and account rules. - [Content Safety & Anti-Abuse Policy](https://natrium.sh/safety): Automated hash screening, anti-abuse, and network integrity rules. - [Cookie & Local Storage Policy](https://natrium.sh/cookies): Strictly necessary HMAC-signed session cookie and local WebCrypto storage disclosure. - [Subpoena & Law Enforcement Policy](https://natrium.sh/subpoenas): Legal process requirements and technical inability to decrypt zero-knowledge vaults. --- ## 4. Autonomous AI Agent Integration (Level 5 Agent-Ready) Natrium implements full discovery and tool execution protocols for autonomous AI agents: ### 4.1 Model Context Protocol (MCP) & WebMCP - **MCP Server Card:** https://natrium.sh/.well-known/mcp/server-card.json - **MCP Configuration:** https://natrium.sh/.well-known/mcp.json - **WebMCP Manifest:** https://natrium.sh/.well-known/webmcp.json - **Supported Tools:** - `search_emails`: Query messages, threads, and folders across the mailbox (`GET /api/email/search?q={query}`). - `send_email`: Compose, encrypt, and dispatch email messages (`POST /api/email/send`). - `request_access`: Submit an application for a zero-knowledge @natrium.sh mailbox (`POST /api/auth/signup-apply`). - `sign_in`: Authenticate a user or agent session (`POST /api/auth/login`). ### 4.2 Agent-to-Agent (A2A) & Discovery Specifications - **Agent Guide:** https://natrium.sh/AGENTS.md - **Authentication Guide:** https://natrium.sh/auth.md - **Pricing & Quotas:** https://natrium.sh/pricing.md - **OpenAPI 3.1 Specification:** https://natrium.sh/openapi.json - **A2A Agent Card:** https://natrium.sh/.well-known/agent-card.json (and https://natrium.sh/.well-known/agent.json) - **Agents Manifest:** https://natrium.sh/agents.json (and https://natrium.sh/.well-known/agents.json) - **Agent Skills Index:** https://natrium.sh/.well-known/agent-skills/index.json - **AI Catalog:** https://natrium.sh/.well-known/ai-catalog.json - **API Catalog (RFC 9727):** https://natrium.sh/.well-known/api-catalog - **OAuth 2.0 Discovery:** https://natrium.sh/.well-known/oauth-authorization-server & https://natrium.sh/.well-known/oauth-protected-resource - **Web Bot Auth Directory:** https://natrium.sh/.well-known/http-message-signatures-directory - **Security Policy (RFC 9116):** https://natrium.sh/.well-known/security.txt - **XML Sitemap:** https://natrium.sh/sitemap.xml --- ## 5. API Reference Summary - **Base URL:** https://natrium.sh/api - **OpenAPI Spec:** https://natrium.sh/openapi.json - **Health Check:** `GET https://natrium.sh/api/health` -> Returns `{"status": "pass", "version": "1.0.0"}` - **Authentication:** Bearer Token (`Authorization: Bearer `), Session Cookie, or RFC 9421 HTTP Message Signatures. --- ## 6. Privacy & Legal Commitments - **Zero-Log Policy:** No behavioral tracking, no advertising pixels, no reading or indexing of private communications. - **GDPR & CCPA:** Full user rights to data portability, rectification, and complete irreversible cryptographic erasure. - **Law Enforcement Requests:** Due to zero-knowledge encryption, Natrium cannot decipher user messages or produce plaintext under subpoenas.