Encryption with a key per organization
Backed-up email and its metadata are encrypted before storage with a key unique to your organization. Keys are themselves encrypted with a master key kept separately from the database.
Security at KnoxDefender
How we protect the email you trust us with.
Two-step sign-in for everyone
Every account, from KnoxDefender staff to your end users, must use an authenticator app. Passwords are hashed with Argon2id.
Strict roles
Company admins manage your organization, auditors get read-only access without email content, and staff see only their own mailbox. Permissions are enforced on our servers, not just hidden in the interface.
Tamper-evident audit trail
Every administrative action is recorded in an append-only, hash-chained log that nobody can edit or delete, including us.
Least-privilege access to your tenant
We request only the Microsoft or Google permissions each feature needs, explain each one before you consent, and can limit access to the mailboxes you enroll.
Honest status
A mailbox is shown as Protected only when backups are current and a test restore has succeeded. Unsupported or unverified signals are shown as unavailable, never as healthy.
Our access to your email
KnoxDefender staff cannot read your messages by default. If you ask us for support that requires it, access needs a recorded reason and a fresh two-step check, lasts at most 30 minutes, and appears in your organization's audit trail.
Certifications
We don't claim certifications we don't hold. If your funder or insurer sends a security questionnaire, we'll answer it accurately.
Found a security issue? Email security@knoxdefender.com.