Get help with c.Email

Overview What is c.Email? c.Email is an app and browser extension that lets you send authenticated, end-to-end encrypted emails from your existing address. Why should I use c.Email? Email, unfortunately, was not designed with security in mind and faces widespread problems with privacy and authenticity. Email providers and hackers can read your emails, leaving your personal data unsafe. Scams and phishing are ubiquitous. To solve this problem, c.Email lets you send authenticated, end-to-end encrypted messages from your existing email address. Email remains ubiquitous because of its simplicity, speed, and availability. We created c.Email from a belief that these features do not have to come at the expense of privacy – and that privacy should be available to everyone. How can I use c.Email? You can download c.Email for iOS on the App Store, or for Android on the Google Play Store. The Chrome extension is available from the Chrome Web Store. How does c.Email work? To use c.Email, just connect your existing email address – you don’t have to create a new account. You then complete a quick, one-time identity check to create your decentralised identity document (DID). This contains your public encryption and verification keys, letting you encrypt and digitally sign your emails. When sending emails, you can then choose between three security levels: Standard: Not authenticated or encrypted. Unencrypted emails can be read by email providers and hackers – leaving you vulnerable to surveillance, data theft, and fraud. Not recommended. Secure: Authenticated and protected with post-quantum secure encryption. Can only be read by you and the intended recipient. For when privacy and trust matter. For Your Eyes Only: Authenticated and only decrypted when the intended recipient is looking at the screen. The reader must pass a continuous liveness check using our biometric decryption technology and a template of the biometric data from their initial identity verification (which is stored on their device, nowhere else). For when absolute secrecy matters. Do I need to create a new account or switch my email? No! c.Email is designed to integrate seamlessly with your existing email accounts, so no need to switch emails or go through a complex setup process. How many email addresses can I add to c.Email? You can add new email addresses to c.Email at any time, with no limit on the number you use. What can I use to prove my identity? You can use a passport or national identity card, as long as it contains an NFC chip (sometimes referred to as an RFID chip or biometric chip). This is because we need to read the data in this chip to store cryptographic proofs of your identity attributes. You can use an expired ID to prove your identity and send authenticated emails in c.Email – however, some future features may require you to have an in-date ID. How does c.Email encrypt my emails? c.Email keeps your emails private using end-to-end encryption (E2EE). This is a method of encryption that ensures only the sender and receiver of a message can read it by only encrypting the message on the sender's device, and decrypting on the receiver's, rather than on servers. Specifically, c.Email uses hybrid public-key encryption (HPKE). This pairs classical and post-quantum cryptography, which means that your emails stay private even if either system is broken at some point in the future. c.Email uses ML-KEM, the post-quantum standard published by NIST (the National Institute of Standards and Technology). c.Email is not involved in the sending process. Instead, emails are encrypted on your device before sending, remain encrypted in transit, and are only decrypted on the recipient's device. Nothing is ever stored, encrypted, or decrypted on our servers. (The only exception to this is for businesses using our Business Self-Serve plan, which encrypts emails on a secure server, hosted either by you or us with key management handled by you.) This means no-one else can read your emails: not your email provider, and not us, even if we wanted to. What is the C-layer? The C-layer is our blockchain. For c.Email, it's where we publish your public encryption key and public verification key. These are public so that you don't need to exchange them with all your chosen recipients before sending them an email (your decryption key, on the other hand, will always be private and stored only on your device). They are published anonymously (containing no email address or name) – and because they are published on-chain, they cannot be tampered with. We created the C-layer to act as a decentralised, privacy-preserving identity directory — initially for c.Email, with more applications coming soon. What is Cdot? Cdot is our framework for encrypted email, messaging, identity, payments, and recovery. Coming soon, it will be available to users as an app designed for everyday use. There will also be a Cdot SDK for developers to integrate into their own apps, allowing them to build quickly using our privacy-preserving trust stack. If you’re interested in testing or building the next generation of digital privacy products, get in touch. How does c.Email compare against other encrypted email providers? In short: we’ve designed c.Email for there to be no trade-offs between privacy and convenience. We think other companies have done great work on privacy. But until now, a solution has not existed that allows users to protect their privacy with end-to-end encryption, and maintains a seamless user experience by allowing them to carry on using the email address they already depend on every day. For more details, check out our dedicated product comparison pages. How much does c.Email cost? c.Email is free for all users. We'll always have a free tier, and will soon be introducing premium features as part of an expanded product suite — watch this space! How can I give feedback on the app? c.Email is a recently developed and launched product, and we’re grateful for all and any feedback. If you have any thoughts to share or issues to resolve, please email support@certonymity.com. Privacy and security Why do I need to verify my identity just to send emails? We verify your identity to confirm that you are who you say you are and that people can trust your emails. You’ll only have to do this once – afterwards, you can connect new email addresses to c.Email at any time. Why do you need ‘full access’ to my email account? This doesn’t mean we’ll be able to read your emails, send anything on your behalf, or see any other sensitive data. It just means you’ll be able to carry on sending and receiving emails in c.Email – but this time, privately and safely. Why do you need access to my camera? Initially, we need to use your camera to complete the identity check at onboarding. Later on, when you receive a For Your Eyes Only email, you need to be looking at the screen to decrypt it. We use the camera to complete a check against a template of your biometric data, stored on your device. No data is captured or stored at this point. What data do you store, and where? When you carry out your initial identity check, your identity information and a template of your biometric data is stored on your device only – they never go anywhere else. This is so you can use our For Your Eyes Only setting (which ensures emails are only decrypted when the intended recipient is looking at the screen, preventing your emails from being read even if your device is stolen when unlocked). Once you have confirmed your identity, we turn your email address into a hash-based message authentication code (HMAC). This is a hash of your email address, combined with a secret key, then hashed again. We link the HMAC to your public verification key and public encryption key via a smart contract executed on our blockchain (the C-layer). The purpose of this is to rule out brute-force guessing of email addresses. When you send or receive an email, c.Email corresponds with the C-layer to retrieve the relevant public key to encrypt and/or authenticate it. These keys are indexed by an arbitrarily chosen random identifier. Our server maintains a mapping from email HMACs to these random identifiers. We don’t store, encrypt, or decrypt any of your data on our server. When you read a For Your Eyes Only email, the content is only decrypted if you continuously pass a liveness check. No data is captured or stored from this check. Your private decryption key, as well as your identity data, remain on your device at all times, and nowhere else. For more information, you can read our privacy policy. A hash is a cryptographic function that converts any piece of data into a fixed-length string of numbers and letters. It is one-way, not reversible: meaning the original data cannot be discovered from the hash. This is why it is safe to store on a blockchain. Why should I trust you with my biometric data? You don’t need to, because we don’t have it in the first place. c.Email doesn’t store your information anywhere but your device, which means it’s not accessible to anyone else – not even us. The reason we ask for it is because it provides greater security than relying on passwords. We will never share your personal data, ever. If you care so much about privacy, why do I need every email to display my full real name? Certonymity is committed to building an internet where privacy is a core feature, not a complicated add-on. Email, by definition, can never be fully anonymous – it’s just not what it’s for. But it’s a key part of the internet (and in many cases, a key part of life full stop) – so we think everyone should be able to send private, safe emails. Our email authentication feature allows people to send and receive emails without fear of fraud, impersonation, or phishing attacks. Anonymous messaging can be saved for other platforms. Has c.Email been audited for security? c.Email has completed a Cloud Application Security Assessment (CASA), the App Defense Alliance framework required by Google for apps that access Gmail data. It verifies that our app meets a recognised baseline of application-security controls — including secure data handling, encryption in transit, and the ability to delete user data on request. Independent penetration tests and cryptographic reviews are planned, with the results to be published. Users can delete their data at any time by uninstalling the app or emailing delete-account@certonymity.com. Can I delete my data? You can delete your data at any time by uninstalling the c.Email app or emailing delete-account@certonymity.com. Using c.Email How does For Your Eyes Only work? For Your Eyes Only is our highest-security setting and requires the intended recipient to pass a continuous biometric presence check to decrypt the email. If they look away from the screen, the email will immediately re-encrypt. How do I sync the c.Email app with the Chrome extension? Once you’ve installed the Chrome extension, you first need to set up a passkey. This encrypts the database containing your private keys for encrypting and authenticating emails, which remains on your browser and nowhere else. The extension will prompt you to do this. After creating your passkey, you’re ready to sync your private keys. To do this: 1. Open c.Email on your phone (the QR code won’t work with your camera app). 2. Tap Account details. 3. Tap Link device. 4. Scan the QR code. You can now start using c.Email in your browser. Only you can sync your keys – if someone else tried to scan your QR code, they’d have to prove ownership of your email address. All information exchanged between your browser and the c.Email app is encrypted. We don’t have access to this data or the key to decrypt it. Can I search my emails even if they’re encrypted? Yes. Emails stored locally (i.e. any email you’ve received or searched for since installing c.Email) can be searched, because emails are decrypted on your device rather than on our servers. Emails not stored on your device (i.e. historical emails pre-dating your use of c.Email) are still searchable, but only with the text in their sender addresses and subject lines. For this reason, these elements are not encrypted in c.Email. If you type your search query and don’t immediately see the email you’re looking for, hit the search button. This triggers a query to the API, which returns all relevant results rather than just the emails stored on your device. Can I send encrypted emails to anyone? You can send an encrypted email to any address, but to read the decrypted text, the recipient will need to be on c.Email. If I send a non-encrypted email, will it still show my verified identity? No. Unencrypted (or ‘not secure’) emails will display the message ‘Real name: unverified’ below your name, even if you have verified your identity before sending. This is because emails can only be sent authenticated and encrypted, or not authenticated or encrypted. Why are some emails highlighted in red? On very rare occasions, you may also see emails highlighted in red and marked ‘dangerous’. This means an email signature is invalid and the sender’s identity cannot be verified. In the majority of cases, this is because a verification key has gone missing for some reason, which means the email has been sent encrypted but cannot be authenticated. (Theoretically, a ‘dangerous’ email could also indicate that someone is trying to impersonate our app.) For example, you could see emails marked as ‘dangerous’ if you have re-verified your identity since receiving the email, but haven’t been through our account recovery process. You won’t be able to read or reply to emails marked in red. Can I recover my account if I lose my private key? Yes. Your private key for email decryption is stored on your device to avoid compromising your privacy. However, to prevent you losing your email data if you lose access to your device, c.Email automatically encrypts a backup key for you. The retrieval process for this key is only triggered when you sign in using biometrics on a new device. When you first download c.Email, you will be prompted to set a password for your backup. Once you have done this, c.Email automatically encrypts and uploads a backup key to your cloud provider, such as Google Drive, iCloud, or OneDrive. To recover your data, install c.Email on a new device and choose the email address you were using previously. Once you have completed authentication with your email provider and identity verification with c.Email, you will be asked for your backup password. c.Email will then retrieve the encrypted backup from the cloud and restore your keys. You can configure this process and change your backup password in your c.Email settings. Can I send emails to someone not on c.Email? Yes. You can send unencrypted emails as normal, and you can also send encrypted emails to someone who is not yet on c.Email. This is made possible through identity-based encryption (IBE): the sender encrypts the message to the recipient's email address, so no previously published recipient public key is required. The recipient receives only an email with a link to install the app; the message itself remains encrypted. When the recipient onboards and proves control of the email address, a decentralised group of key authorities then jointly issues the decryption key associated with that email address, allowing the recipient to open messages that were sent before they joined. Because the recipient proves email ownership on installing c.Email, and because no single key authority can issue the decryption key alone, only the recipient can read the encrypted email. Once the recipient is on c.Email, encryption proceeds as normal. Why can’t I verify my identity? If you’re unable to scan your document with the camera in the app, make sure you’re in a place with good lighting and your document is laying flat. If you’re unable to scan your document’s NFC chip, make sure you’re holding it to the upper-back part of your device. If you’re scanning a passport, try scanning the back first, then the front if that doesn’t work, then the photo page if that doesn’t work. You may need to move your device around slightly until it vibrates, indicating a successful scan. If you’re unable to complete the liveness check, make sure you are in a place with good lighting and are holding the device still during the check. What gets encrypted when I send an email? We encrypt your emails’ body and attachments, but not their recipient addresses or subject lines. This is to ensure you can search your entire email archive, rather than only emails stored locally. Can I send encrypted emails without verifying my identity? No. c.Email was created to add both privacy and safety to your daily email. For this reason, we do not support encrypted but unauthenticated emails. Our identity verification makes it immediately easy to spot scams, fraud, and suspicious emails, and works through cryptographic proofs, not by exposing your personal data. What happens if I send an encrypted email to someone not on c.Email? You will be able to send an encrypted email to someone who doesn’t yet c.Email. To decrypt it, the recipient will need to download c.Email. The email they receive will contain a link for them to do so. Do I need to verify my identity every time I add a new email address? No — verifying your identity in c.Email is a one-off process. You can add new email addresses at any time without having to redo it. Do c.Email or recipients see my ID when I send a verified email? No — recipients see your name with a verified blue tick under your email address. This happens because emails are signed with a cryptographic signature attesting to the fact that you have verified your identity previously. Is c.Email available for businesses? Yes – we have two implementation options available. Self-Serve is our self-serve encryption service, with emails encrypted and decrypted on either your existing mail server or a new secure server provided by us. Plus offers highly secure client-side encryption, with one decentralised identity document (DID) per business. See c.Email for businesses for more. How does AgePass work? AgePass gives you a way to pass online age verification without revealing your personal data, and works using c.Email’s cryptographic identity verification. When you sign up and prove your identity with c.Email, we convert the information on your ID into anonymous cryptographic proofs (e.g. ‘is over 18’, ‘is over 21’, and so on). On age-gated platforms that accept AgePass, you can sign in with your email to automatically prove that you are above the required age threshold. The platform receives only the cryptographic proof, without seeing your ID or personal data.

FAQ

Contact

For press enquiries, please email press@certonymity.com or view our press kit here. For customer support or questions about using c.Email, please go to our help centre or email support@certonymity.com. For any other enquiries, please email info@certonymity.com.

Using c.Email

Adding email signatures

To create a new email signature, go to your c.Email settings. You can either create individual signatures for different accounts, or a global signature to apply automatically across all accounts.

Using c.Email

Receiving emails

As with the emails you send, every email you receive will come with a security label: Not Secure: Not authenticated or encrypted. This means that it’s technically possible for your email provider or a hacker to read it, and that it lacks cryptographic evidence that it’s from who it says it’s from. These emails will display the message ‘Real name: unverified’ below the sender’s name, even if they have verified your identity before sending. This is because emails can only be sent authenticated and encrypted, or not authenticated or encrypted. Authenticated: Appears with the sender’s verified real name, meaning you can be sure that the email is really from who it says it’s from. Secure: Authenticated and end-to-end encrypted, meaning it can only be read by you. Secure emails display the sender’s verified real name. For Your Eyes Only: Authenticated, end-to-end encrypted, and protected with our face unlock technology. To decrypt a For Your Eyes Only email, you need to look continuously at the screen, passing a continuous liveness check using a template of the biometric data from your initial identity verification (stored only on your device). If you look away from the screen, the email content will turn back into encrypted text. This is our highest security level and means that even if someone else were to access your unlocked device, they wouldn’t be able to read your emails. By default, c.Email groups your messages (meaning you can see all emails from the same thread in one place). You can turn this off in your c.Email settings.

Using c.Email

Sending emails

You can send emails from any of the email addresses you have added to c.Email by choosing from the drop-down menu in the From field. You can change your default email address by clicking the button to show your active accounts in the top right of your inbox. You can send emails with four different security levels: Not secure: Not authenticated or encrypted. Unencrypted emails can be read by email providers and hackers – leaving you vulnerable to surveillance, data theft, and fraud. Not recommended. Authenticated: Signed with cryptographic proof of the sender’s identity. Secure: Authenticated and protected with post-quantum secure encryption. Can only be read by you and the intended recipient. For when privacy and trust matter. For Your Eyes Only: Authenticated and only decrypted when the intended recipient is looking at the screen. The reader must pass a continuous liveness check using our face unlock technology and a template of the biometric data from their initial identity verification (which is stored on their device, nowhere else). For when absolute secrecy matters. If you haven’t confirmed your identity in the app, you won’t be able to authenticate or encrypt your emails. By default, all your drafts will be encrypted automatically. c.Email will also prompt you to confirm your identity via face unlock when sending encrypted emails. You can turn both of these off in your c.Email settings. It is possible to send encrypted emails to someone who is not yet on c.Email. This is made possible through identity-based encryption (IBE): the sender encrypts the message to the recipient's email address, so no previously published recipient public key is required. The recipient receives only an email with a link to install the app; the message itself remains encrypted. When the recipient onboards and proves control of the email address, a decentralised group of key authorities then jointly issues the decryption key associated with that email address, allowing the recipient to open messages that were sent before they joined. Because the recipient proves email ownership on installing c.Email, and because no single key authority can issue the decryption key alone, only the recipient can read the encrypted email. Once the recipient is on c.Email, encryption proceeds as normal.

Data and permissions

Permissions

Gmail/Outlook authentication: When you first download c.Email, you will be prompted to grant the app access to your Gmail or Outlook account. This is so you can send and receive messages in c.Email. Authentication will take place via your existing provider’s usual portal. Biometrics (Face ID or fingerprint): c.Email uses biometric sign-in as a more secure alternative to passwords. You will be prompted to allow c.Email to enable biometrics when you first download the app. If you are using iOS, this will be Face ID. If you are using Android, this will be a fingerprint scan. Camera access: You will need to grant camera access to complete your liveness check when verifying your identity. When you receive a For Your Eyes Only email, it will only be decrypted when you are looking at the screen. We use the camera to complete a check against a template of your biometric data (taken from your ID when you verify your identity and stored on your device only). No data is captured or stored at this point. Contact access: This is optional and turned off by default, but can be turned on in your c.Email settings. Granting contact access will result in improved contact suggestions when composing emails.

Get help with c.Email

Overview

Setup

Using c.Email

Troubleshooting

Data and permissions

FAQ

FAQs

Contact

Adding email signatures

Receiving emails

Sending emails

Permissions