ASTIS Mail
End-to-end encrypted email client for Gmail and Microsoft 365
Keep Gmail or Microsoft 365 — no migration. ASTIS Mail is a Progressive Web App that encrypts on your device, so your provider, cloud, and ASTIS route and store only ciphertext, never your message plaintext.
What ASTIS Mail Does
ASTIS Mail connects to your Gmail or Microsoft 365 account and encrypts your emails end-to-end using OpenPGP and AES-256-GCM.
Plaintext never leaves your device
Every email is encrypted with AES-256-GCM on your device before it leaves. Only the intended recipient can decrypt it.
Your provider never sees message-content plaintext
Your mailbox provider routes and stores only ciphertext — email content and attachments are encrypted on your device. (Routing metadata — addresses, timestamps — remains visible to the provider, as in any email system.) ASTIS never stores plaintext session keys; during approved onboarding rewrap, SKEY may be processed transiently in memory solely to re-encrypt the capsule for the recipient.
Works Everywhere
Progressive Web App that works on desktop, tablet, and mobile. No app store download required — just open your browser.
Gmail & Microsoft 365
Connect your existing Gmail or Microsoft 365 account. ASTIS Mail works as an encryption layer on top of your current provider.
Automatic Key Management
OpenPGP keys are generated and managed automatically. Recipients are discovered via Web Key Directory (WKD) — no manual key exchange.
On-Device Storage
Decrypted emails are stored locally in your browser. Your data stays on your device, not on our servers.
How It Works
ASTIS Mail uses OAuth to connect to your email provider and encrypts everything client-side.
Connect Your Email
Sign in with your Gmail or Microsoft 365 account using OAuth. ASTIS Mail gets permission to read and send emails on your behalf.
Encryption Keys Generated
An OpenPGP key pair is created on your device. Your public key is published to ASTIS WKD so others can find you.
Send Encrypted Emails
When you compose an email, ASTIS Mail encrypts it client-side with AES-256-GCM. The encrypted session key capsule is stored on ASTIS infrastructure.
Recipient Decrypts
The recipient's ASTIS client retrieves the session key capsule, decrypts it with their private key, and decrypts the email — all on their device.
Data & Permissions
ASTIS Mail requests the minimum OAuth permissions needed to function. Here is exactly what we access and why.
What we do NOT access
ASTIS never stores, processes, or has access to your email content on our servers. All email data is processed exclusively on your device. We do not sell, share, or use your data for advertising. See our Privacy Policy for full details.
More Features
Beyond encrypted email — ASTIS Mail includes tools for enterprise teams and power users.
Message TTL & Expiry
Set time-to-live on encrypted emails. Session key capsules expire automatically — expired emails cannot be decrypted.
Encrypted Attachments
Attachments are encrypted alongside the email body with the same AES-256-GCM encryption.
Real-Time Sync
Changes sync in real-time across all your devices via your email provider.
Enterprise Ready
Organization key management, HYOK key custody, audit logging, and compliance controls for business teams.
Remote Device Wipe
Business plans only: organization admins can remotely wipe encrypted mail and keys from a lost, stolen, or offboarded device — cryptographically signed and gated by step-up admin approval.
Encrypted Calendar
Built-in calendar with end-to-end encrypted events, integrated with Microsoft 365 calendar.
Contacts & GAL
Encrypted contact management with Global Address List support for organizations.
Run it under your own brand
ASTIS Mail is a reference client. Banks and regulated organizations can ship the same encrypted workspace under their own brand, on their own key custody — without building cryptography, key management, or audit from scratch.
Your brand, your domain
Your name, logo, and colors on the client at mail.yourcompany.com. Mail and Calendar included.
Embed in your portal
Drop the encrypted workspace into your existing customer portal as an embedded module.
Your custody
Run the CryptoVault on a dedicated cluster in your own infrastructure. Keys never leave your environment — ASTIS cannot decrypt.
Branded for your recipients
The encrypted message your external recipients open carries your brand, not ours.
Delivered as a dedicated deployment — "Secured by ASTIS" co-brand. Sales-led, not self-serve.
Supported Platforms
Gmail
Google Workspace and personal Gmail accounts via OAuth 2.0
Microsoft 365
Outlook, Exchange Online, and Microsoft 365 accounts via OAuth 2.0
Security at a Glance
Ready to encrypt your email?
Connect your Gmail or Microsoft 365 account and start sending encrypted emails today.