Enterprise Trust & Infrastructure Security

Security Architecture

Enterprise Data Protection • Operated by Cyphex Agency (cyphex.agency)

Enterprise Infrastructure Governed by Cyphex Agency

Cyphex Mail (mail.cyphex.agency) protects confidential corporate correspondence with bank-grade zero-trust principles. Every customer mailbox operates with dedicated cryptographic separation, Cloudflare edge shielding, and Amazon SES high-trust IP pools.

TLS 1.3 / HSTS

Zero-Trust Edge Architecture

Every request is individually verified, authenticated, and authorized at the network edge. No internal resource is trusted implicitly.

Cryptographically signed session tokens

Short-lived access tokens with automatic rotation

Strict tenant data isolation across Postgres schemas

Encrypted transit via TLS 1.3 with HSTS preloading

330+ Edge POPs

Global Cloudflare Edge & WAF

Distributed across 330+ edge locations worldwide. Automatic DDoS mitigation, bot inspection, and web application firewall rules protect against zero-day exploits.

Unmetered Layer 3, 4, and 7 DDoS shielding

Zero-latency DNS resolution via Cloudflare

Intelligent rate limiting on authentication endpoints

Automatic TLS certificate renewals and HTTP/3 support

Google Verified

Google API User Data Compliance

Fully compliant with Google's Limited Use Policy. We never read, store, or train AI models on your private customer emails or profile data.

Zero AI model training on private mailbox contents

Zero reselling, marketing, or advertising use of user data

Strict CSRF state verification on OAuth callbacks

One-click workspace deletion and data export

AES-256 GCM

Server-Side Encrypted Storage

Raw MIME emails and sensitive attachments are encrypted at rest using AES-256 before being written to high-durability cloud object storage.

Isolated storage buckets for raw emails and attachments

Presigned expirable URLs for secure document downloads

Immutable backup retention with daily automated snapshots

Payload sanitization and malformed attachment rejection

TOTP Authenticator

Multi-Factor Authentication (2FA)

Safeguard against password compromise with time-based one-time passwords (TOTP) and emergency recovery keys.

Google Authenticator, Microsoft Authenticator & Authy support

Encrypted emergency one-time recovery backup codes

Device trust verification on authentication endpoints

Immediate session termination upon credential changes

Audit Ready

Immutable Real-Time Audit Logs

Every administrative operation, login attempt, inbox creation, and settings update is immutably timestamped and recorded.

Records client IP address, user agent, and timestamp

Searchable audit trail accessible by workspace admins

Tamper-proof append-only database logging

Real-time alerts for anomalous login locations

Back to Home