Replaces MailStore and Piler
IronSeal
An archive that can prove nothing in it changed.
IronSeal captures every message as it is sent and received, then seals the whole archive into a Merkle tree every night. The claim is not that we stored your mail — it is that you can demonstrate, later, that nobody altered it.
Built and deployed, archiving live mail. Multi-tenant and reseller support are in production.
- Capture
- SMTP journal stream, archived before delivery completes
- Integrity
- Nightly Merkle root over the whole archive
- Search
- Full-text across headers, bodies and attachments
- Retention
- Per-tenant policies, retained until the policy says otherwise
- Encryption
- Bodies and attachments encrypted per tenant
- Access
- Web client, LDAP sign-in, Thunderbird plugin
A seal you can check, not just trust
Every night the archive is hashed into a Merkle tree and the root is recorded. Any later change to any message changes the root, so an auditor can verify the chain rather than take your word for it.
It fails closed, loudly
If storage or the database is unhealthy, IronSeal returns a temporary SMTP failure and the sending server holds the message and retries. It does not accept mail it cannot archive. This design exists because the archiver it replaced failed the other way.
Never in the way of live mail
Archiving happens on its own path and relays asynchronously, so a slow archive never becomes slow email. Disk watermarks raise the alarm long before the volume is full.
Search that returns the message, not a list of maybes
Full-text indexing across a whole organisation's mail history, filtered to exactly the mailboxes the person searching is allowed to see.
Users can get their own mail back
A Thunderbird plugin and the web client let people restore messages themselves, which is most of what an archive actually gets used for day to day.
Built for resellers
Capabilities are split so a reseller administers their own customers without seeing anyone else's, and every administrative elevation is written to an audit log.
Listed so you can decide with the whole picture rather than discover it after signing.
- Encrypting the full-text index — message bodies and attachments are encrypted per tenant today, but the search index is not, and we would rather say so than let you assume otherwise
- Further reseller self-service, beyond the capability split already shipped