# Secure Mail

Encrypted conversations with attachments, with contacts or with guests outside Databeamer.

**Secure Mail** is for conversations rather than one-off deliveries: a subject, a thread of messages and attachments, readable only by the people in the conversation. Find it under **Exchange › Secure Mail**.

## Sending a message

Choose **New Secure Mail** and fill in **To**, optional **Cc** and **Bcc**, a **Subject** and your message. **Attach files** adds attachments, up to your plan's limit per message. Click **Send**.

Recipients with an account read and reply inside Databeamer. For guests, Secure Mail works like a [transfer](https://databeamer.eu/en/docs/transfers/send-a-transfer): they get a link by email and unlock it with a **passphrase** you share separately, or with a **code by email**. Guests can read the message, download attachments and **Send reply**. Their access ends after 30 days, and you can **Recall delivery** for a guest at any time.

> **Security details**
>
> - A conversation has a group key set shared by its members. Each message is encrypted with its own content key (ChaCha20-Poly1305, bound to the conversation and message ids), and that key is wrapped under the conversation's symmetric key.
> - Attachments each get a fresh file key. The attachment's name, type, size and key travel inside the encrypted message; the server only sees which encrypted files belong to which message.
> - A guest gets an envelope opened by the same two mechanisms as a transfer (passphrase derived with Argon2id, or a KMS-escrowed key released after an emailed code). Guest replies are encrypted with a per-reply key wrapped both to the conversation and to the guest's envelope.
> - **Recall delivery** destroys that guest's envelope key material and link tokens. Content the guest already fetched while unlocked cannot be taken back.
> - Notification emails name the sender and carry the link, never the subject or the text.

## Conversations

- Filter the list by **All conversations**, **Started by me**, **Unread** or **Waiting for reply**.
- **Add member** brings another account into the conversation. They see messages from that point on; use **Grant history** if they should read the earlier ones too.

> **Security details**
> Adding a member rotates the conversation key and gives the newcomer only the new version, so earlier messages stay closed to them. **Grant history** has an existing owner or admin wrap the older key versions to the newcomer with ECIES; it is recorded as a signed audit entry.

## Limits

Your plan sets how many new secure mails you can start per month. Replies are never counted. Organisations can additionally enable shared mailboxes; ask your organisation owner.