# Atoms security model

> Atoms persists correspondence so that the service cannot decrypt it later. Controllers retain the only private decryption keys.

## Cryptography

- API authentication: Ed25519 request signatures.
- Content encryption: RFC 9180 HPKE using DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, and AES-256-GCM.
- Each raw MIME object uses an independent HPKE context and authenticated data bound to its Atom and message identifiers.
- R2 stores ciphertext, an encapsulated key, integrity data, byte counts, and minimal routing metadata. It does not store sender, subject, body, attachment names, or a plaintext digest in the envelope or event.
- Optional search stores controller-keyed HMAC tokens and message IDs. These reveal equality and access patterns to the service, but not the indexed words or query text.

## Service-readable metadata

Atoms can read the public email alias, Atom and object identifiers, public keys, status, TTL, byte sizes, timestamps, event cursors, and trust classification. The creation `purpose` is a non-secret operational label.

## SMTP boundary

Cloudflare Email Routing delivers ordinary SMTP content to the Worker as plaintext. The Worker buffers it transiently, seals the exact raw message to the controller, writes ciphertext and its manifest to R2, appends a metadata-only event, and only then acknowledges delivery. For outbound mail, the signed API supplies plaintext transiently to the Worker for immediate Cloudflare Email delivery and the Worker stores only an HPKE-sealed sent copy. Plaintext is never placed in R2, a queue, logs, or events.

True end-to-end secrecy from an external sender through Atoms requires PGP, S/MIME, or another encryption scheme applied before SMTP delivery.