Security Architecture

1. The Zero-Knowledge Cryptographic Model

Legacy email providers encrypt data “at rest” using a single shared server key while retaining full access to plaintext user credentials and message bodies. Under that model, cloud administrators, third-party ad scanners, or database breaches expose every user's inbox simultaneously.

Natrium enforces a defense-in-depth Zero-Knowledge Cryptographic Architecture: every user mailbox is isolated by its own cryptographic key hierarchy, plaintext account passwords are never stored, and every sensitive database column and disk attachment is sealed with authenticated AES-256-GCM encryption.

2. Memory-Hard Key Derivation (scrypt N=32768) & HMAC Peppering

To defeat GPU/ASIC password cracking clusters and rainbow-table attacks, Natrium processes all user authentication and recovery secrets through a multi-stage cryptographic pipeline:

• Server-Side HMAC-SHA256 Pepper: Before key derivation, the password input is combined with a high-entropy server-side HMAC-SHA256 cryptographic pepper stored exclusively in protected volatile environment memory.
• Memory-Hard scrypt (N=32768, r=8, p=1): The peppered secret is stretched with a unique per-user 128-bit cryptographic salt using scrypt with cost factor N=32768 (requiring 32 MB of contiguous RAM per hash evaluation) to produce a 512-bit derived output.
• Server-Key Encrypted Salts & Hashes at Rest: Both the per-user cryptographic salt and the resulting password verifier hash are further protected with authenticated AES-256-GCM before being written to the persistence layer, ensuring offline database dumps reveal zero raw hashes or salts to an attacker.
• Constant-Time Verification: All authentication comparisons execute via constant-time equality comparisons to eliminate side-channel timing attacks.

3. Per-User Data Encryption Key Envelopes & AES-256-GCM Storage

Natrium isolates each tenant's cryptographic vault using a dedicated envelope encryption hierarchy:

• Per-User Data Encryption Key (DEK Envelope): Every user account is assigned a unique 256-bit random Data Encryption Key (DEK) sealed under a user-specific Key Encryption Key (KEK) derived via memory-hard scrypt from the user's account password.
• Authenticated Field Encryption: Email bodies, subjects, sender/recipient headers, drafts, personal notes, custom signatures, and TOTP secrets are individually encrypted with AES-256-GCM using a fresh 96-bit initialization vector (IV) and 128-bit authentication tag.
• Encrypted Disk Attachment Blobs: Attachment files are sealed on disk as authenticated binary .enc blobs with a unique IV and GCM integrity tag.

4. Direct-MX Outbound MTA, DKIM Signing & TLS 1.3 Transit

Our outbound Mail Transfer Agent delivers mail directly from our sovereign infrastructure without third-party relay services:

• Dynamic DNS MX Resolution: Outbound messages resolve recipient MX records directly and establish encrypted SMTP sessions over TLS 1.3 with Perfect Forward Secrecy.
• In-Memory Attachment Decryption: When sending an email with attachments, outbound attachment blobs are decrypted strictly into ephemeral memory buffers for MIME assembly; plaintext files are never written back to disk.
• Cryptographic DKIM, SPF & DMARC: All outbound mail is signed with 2048-bit RSA DKIM keys and verified against strict SPF (-all) and DMARC (p=reject) policies, backed by DNSSEC-signed zones.

5. Multi-Engine Attachment Threat Screening & Sandbox Detonation

Weaponized email attachments (trojanized PDFs, macro-enabled documents, archive bombs) are the primary vector for endpoint compromise. Natrium automatically screens inbound and uploaded attachments against 70+ commercial antivirus engines via the VirusTotal API and Falcon Sandbox / Hybrid Analysis behavioral heuristics. Any file flagged as malicious or matching our prohibited signature registry is quarantined before download.

6. Tracking Pixel Neutralization & Phishing Telemetry

Natrium sanitizes all incoming HTML messages prior to display, stripping 1x1 spy pixels, invisible web beacons, and dangerous script/iframe tags. Users also have one-click access to inline RFC 8058 List-Unsubscribe dispatch, personal sender blocklists, and instant phishing reporting that quarantines malicious messages and feeds real-time indicators into our SIEM.

7. Continuous Security Monitoring & Threat Defense

Natrium maintains enterprise-grade security monitoring and perimeter defenses to protect platform integrity:

• Perimeter Access Control: Cloudflare edge routing combined with stateful server-side rate-limiting mitigates automated scanner probes, brute-force attempts, and volumetric denial-of-service traffic.
• Automated Anomaly Isolation: Continuous telemetry detects suspicious access patterns, automatically revoking compromised sessions and isolating abusive traffic at the network edge.
• Immutable Baseline Protections: Core application firewalls enforce strict input sanitization, parameterized SQL queries, and payload validation to neutralize common web application vulnerabilities (OWASP Top 10).

8. Hardware WebAuthn Passkeys, TOTP 2FA & Session Hardening

Accounts support both RFC 6238 TOTP authenticator apps (with AES-256-GCM encrypted secrets and scrypt-hashed single-use backup codes) and phishing-resistant FIDO2 / WebAuthn Hardware Passkeys (YubiKey, Apple Touch ID / Face ID, Windows Hello). Authenticated sessions use HttpOnly, SameSite=Lax cookies signed with HMAC-SHA256 and bound to server-side session records that can be revoked individually or globally at any moment.

9. Content-Security-Policy (CSP), HSTS & Self-Hosted Asset Isolation

Every HTTP response from natrium.sh enforces strict security headers:

• Strict-Transport-Security: max-age=63072000; includeSubDomains; preload (2-year HSTS preload).
• Content-Security-Policy restricting scripts, fonts (font-src 'self' data:), frames (frame-ancestors 'none'), and base URIs.
• X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy disabling camera, microphone, and geolocation access.

10. Continuous Automated Verification Audits

Prior to every production deployment and zero-downtime release, Natrium executes a comprehensive end-to-end automated system audit verifying HTTP security headers, WebMCP/A2A agent discovery schemas, account lifecycle encryption, attachment integrity, linked-account isolation, and SIEM event logging.

11. Community Vulnerability Disclosure Program (VDP) & Bug Bounty

While Natrium actively prepares for formal accredited third-party lab audits (e.g. Cure53 / SEC Consult), our engineering architecture operates under continuous external scrutiny. We invite ethical hackers, security researchers, and academic cryptographers to audit our platform defenses under our coordinated Vulnerability Disclosure Program (VDP) and active Bug Bounty framework.

Safe Harbor & Researcher Protections: Natrium provides legal safe harbor under the Computer Fraud and Abuse Act (CFAA) and Digital Millennium Copyright Act (DMCA) for security testing conducted in good faith against your own accounts or test mailboxes without compromising other users' privacy, disrupting service availability (no DoS/DDoS), or modifying third-party data.

Submitting Security Findings: Researchers can report actionable proof-of-concept reports to our security engineering desk at security@natrium.sh or via RFC 9116 discovery at /.well-known/security.txt. All valid reports are acknowledged within 24 hours, validated within 72 hours, and remediated in accordance with a standard 90-day coordinated disclosure policy (or 30 days where accelerated remediation is mutually agreed).