YOUR MESSAGES.
YOUR MONEY.
PROTECTED.
Qixit's Summa Network™ combines military-grade AES-256 message encryption, BCrypt-hardened passwords, and Azure cloud infrastructure to give you a messaging and payments platform that's genuinely private — not just privately hosted.
WHAT PROTECTS YOU
Passwords You Can Trust
Your password is never stored — not anywhere. When you create an account, your password is run through BCrypt at work-factor 12, producing a 60-character one-way hash. Even with full database access, no one can recover your password.
A brute-force attacker trying every possible 8-character password against one BCrypt-12 hash would need years on modern hardware.
Messages Only You Can Read
Every personal message is encrypted with AES-256-GCM before it ever reaches our database or cloud storage. The ciphertext is stored in Azure Blob Storage — not in SQL — so it's doubly isolated from any breach.
System messages, receipts, and marketing messages are stored as-is (plaintext) since they're platform-generated and non-private.
Cloud Storage Built to Scale
Message bodies live in Azure Blob Storage, not in SQL. That means your inbox loads faster (no multi-megabyte EML columns in queries), your data is backed up independently, and storage costs stay low as you accumulate years of messages.
Old messages automatically move to cheaper storage tiers — you only pay a small retrieval fee if you need to access archived content.
SECURITY
UNDER THE HOOD
Passwords — Hashed, Never Stored
The moment you type your password, it undergoes a cryptographic transformation called BCrypt hashing. A random "salt" is mixed in to make every hash unique — even if two users choose the same password, their hashes look completely different.
When you log in, the platform re-runs the same transformation and compares results. Your plaintext password never touches a database, never appears in a log file, and is never transmitted beyond your login request.
"A database breach exposes only bcrypt hashes. Without the original passwords, these are cryptographically worthless to an attacker."
EJgD.mSouPHR9ab
djqL6DxKmN3...
Personal Messages — Encrypted Before Storage
When you send a personal message, the platform encrypts the body using AES-256-GCM (the same algorithm used by Signal, WhatsApp, and the US military) before the data ever reaches a database or cloud bucket.
The encryption key (the Platform Key Encryption Key, or KEK) is held in Azure Key Vault — a hardware-security-module-backed secret store that maintains its own audit trail. Accessing the KEK requires authenticated Azure credentials; it cannot be queried directly from SQL.
This means that a breach of the SQL database, or even the Blob Storage container, yields only ciphertext. Without Key Vault access, there is nothing to read.
MxTWBi5POcGG9cFg
JO5G3iw==:J5Ab...
Sessions That Survive Server Restarts
Previously, every time a server was updated or restarted, all logged-in users were silently kicked out — their refresh tokens vanished with the server process. This led to confusing logout loops.
Refresh tokens are now stored in a dedicated database table
(tbRefreshTokens), with expiry dates, device IP tracking,
and explicit revocation support. Server restarts are now transparent to
logged-in users.
When you log out, your token is revoked immediately in the database — making it impossible to reuse, even if it were intercepted.
Family Accounts & Business Partners
Access control works at the account GUID level, not the username level. This has elegant consequences for shared accounts:
Parents and minors: A minor's messages are delivered
directly to the parent's inbox. The parent's account GUID owns the
tbMailReceived rows. No special decryption needed —
the parent simply has inbox access.
Business partners: All usernames under a business account share a primary GUID. Messages to any business alias land in the shared inbox. Partners see the same messages without separate encryption keys.
This design also means encryption is seamless — one encrypted blob serves all members of a shared GUID, with no key duplication.
SMART STORAGE,
FAIR PRICING
Message bodies are stored in Azure Blob Storage with automatic tiering. Recent messages stay in fast Hot storage at no retrieval cost. Older messages move to cheaper tiers automatically — with transparent retrieval fees if you ever need them.
All recent messages. Instant access — no retrieval fee. The default state for new messages.
Messages older than 90 days. Clearly marked in your inbox. Retrieve to Hot for $2.00 + $0.10/MB.
Long-term cold storage for messages older than one year. Ultra-low cost for rarely accessed history.
Download any message to your device. Server copy is deleted. No future storage or retrieval fees — ever.
"Azure Blob Storage Hot tier is approximately 15× cheaper than SQL Server storage. Moving message bodies out of SQL reduces database size, speeds up every inbox query, and makes backups dramatically faster."
YOUR ARCHIVE,
YOUR DEVICE
Never Pay a Retrieval Fee Again
Any message in your inbox can be downloaded to your browser's local storage (IndexedDB). Once confirmed, the server copy is permanently deleted. Your message now lives only on your device — no monthly storage charge, no retrieval fee.
Reading a locally stored message still requires signing in to Summa. We decrypt on-demand, server-side — your device holds the encrypted blob, but decryption happens with your authenticated session. This means device theft alone cannot expose your messages.
Prefer a fully offline copy? Use the "Export Readable Copy" option instead — your message is decrypted on our server and downloaded as a self-contained HTML file you can open in any browser, without an account, forever. No server copy deletion in this case.
Offloaded messages show a green Local badge in your inbox. Messages offloaded on another device show a grey Offline badge — readable only on the device where they were downloaded.
2. Browser downloads encrypted blob
3. Store in IndexedDB (local device)
4. Confirm → server blob deleted
5. Badge: LOCAL ●
2. Returns as .html file download
3. Server copy unchanged
4. Open in any browser, forever
5. No account needed to read
BEFORE &
AFTER
Every item below has been implemented and live-tested on the platform.
tbMail.EML varchar(max) — every DBA can read every messagetbRefreshTokens — survive restarts; revocablevarchar(max) body columnsUNDER THE
HOOD
| Component | Specification | Detail |
|---|---|---|
| Password hashing | BCrypt-12 | BCrypt.Net-Next library, work factor 12. Includes random salt per hash. 60-char output stored in chrPassword. |
| Message encryption | AES-256-GCM | SummaCrypto.Modern library. Random 96-bit nonce per message. 128-bit authentication tag. Format: V2:<base64-nonce>:<base64-ciphertext>. |
| Encryption key | 256-bit Platform KEK | Stored in Azure Key Vault (HSM-backed). Not in SQL, not in application config. Key Vault access logged per-operation. |
| Blob storage | Azure Blob Storage | Container: messages. Blob name = MailId (GUID). Private access only. Lifecycle: Hot → Cool (90d) → Archive (365d). |
| SAS URL expiry | 1 hour | Time-limited Shared Access Signatures for client-side direct blob download. Read-only permission, single-resource scope. |
| Client offload store | IndexedDB | Browser-native key-value store. Keyed by MailId. Stores raw blob content (encrypted or plain). Quota monitored in settings. |
| Access tokens | JWT (HS256) | Short-lived access tokens. Claim ClaimTypes.NameIdentifier = User GUID. Standard expiry with refresh rotation. |
| Refresh tokens | tbRefreshTokens (SQL) | Token hash stored (not raw token). Expiry, IP, revocation flag. Purged on logout. Survived server restart. |
| Tier update | Background worker | Daily job: HOT→COOL at 90 days, COOL→ARCHIVE at 365 days. OFFLOADED messages skipped permanently. |
| Lawful access | Four-Party Quorum-controlled API | Court ordered decryption can only be undertaken after review and concurrence of attorney and multiple employees, including OWNER-level admin credentials. Every decrypt request logged to tbLawfulAccessAudit with warrant info, reason, decision steps, and if authorized, the IDs of all approvers. |
| Transport | TLS 1.2+ (HTTPS) | All API traffic over HTTPS. HTTP redirects to HTTPS. HSTS headers enforced in production. |
| Retrieve Cool | $2.00 + $0.10/MB | Base fee plus per-megabyte charge. Charged to account balance. Receipt generated. Message moved to HOT tier. |
| Retrieve Archive | $7.00 + $0.20/MB | Higher base fee for deeper cold storage. Same receipt and balance-deduction flow as Cool retrieval. |