Zero-access mailbox architecture: How Kosh ensures we can never read your emails
A technical walkthrough of client-envelope encryption, public-key storage isolation, and why modern email platforms should never train machine learning models on your team's customer conversations.
CIPHER_ALGORITHM: AES-256-GCM
KEY_EXCHANGE: Curve25519 / Ed25519
PAYLOAD_INTEGRITY: SHA-256 HMAC Verified
SERVER_DECRYPTION_CAPABILITY: ZERO (Mathematically Impossible)
In an era where tech conglomerates openly scan customer communications to fine-tune generative AI models and serve targeted ads, email confidentiality has never been more vital. At Kosh, privacy isn't just a policy—it is cryptographically enforced.
What is Zero-Access Encryption?
Most providers encrypt emails 'in transit' (using TLS) and 'at rest' (on their disk arrays). However, they retain the master private decryption keys. This means any rogue employee, compromised server credential, or subpoena allows third parties to read your private mail in plain text.
Zero-access encryption changes the paradigm: emails arriving at our mail relays are immediately encrypted using your public key. Once encrypted, only your client device possessing your private decryption key can unseal the content.
// Client-side decryption flow:
const sealedEnvelope = await fetchEncryptedMessage(messageId);
const plaintext = await crypto.subtle.decrypt(
{ name: "AES-GCM", iv: sealedEnvelope.iv },
userPrivateKey,
sealedEnvelope.ciphertext
);Why We Don't Train AI on Your Inboxes
Our business model is simple: you pay a fair price for dedicated domain email infrastructure. We do not monetize your data, sell ad inventory, or feed your proprietary customer correspondence into LLM training corpuses.
Your company's emails, contracts, NDAs, and customer relationships remain 100% confidential and owned entirely by you.
All mail databases are hosted in ISO-27001 certified facilities with hardware security modules (HSMs) ensuring physical and digital separation.
Key Takeaway
Email is the root of your digital identity. By adopting zero-access cryptographic standards, Kosh guarantees that your messages remain strictly between you and your recipients.
Parminder Singh
AuthorFounder & Architect, Kosh
Building private, transparent email infrastructure for modern teams and creators.
Read next
Email Deliverability PSA: 1024-bit DKIM keys are being flagged by major inboxes
Google, Yahoo, and Microsoft have tightened sender authentication thresholds. Domains still signing with legacy 1024-bit RSA keys are experiencing degraded spam scores. Here is what changed and how Kosh automatically deploys rotating 2048-bit DKIM keys.
Read articleApr 28, 2026 • 6 min readMigrating 100,000+ mailboxes from Google Workspace without dropping a single email
How we engineered a streaming IMAP synchronization pipeline that preserves message hierarchies, migrates attachments in parallel, and verifies DNS cutover without duplicate UID propagation.
Read articleReady to get started?
Join thousands of users who are already building the future with Kosh.