Provider-based private-key custody
Signing and decryption operations are delegated through a cryptographic operations layer. On Windows, private keys can remain protected by the operating system’s cryptographic provider.
SendSecure combines a Rust API, React and Vite web application, PostgreSQL persistence, provider-based cryptographic operations, and Railway-oriented deployment architecture.
The platform is designed to keep security-sensitive operations explicit, testable, and separated from ordinary application concerns.
Signing and decryption operations are delegated through a cryptographic operations layer. On Windows, private keys can remain protected by the operating system’s cryptographic provider.
Message and attachment content is encrypted with symmetric keys, while recipient public keys protect access to those content keys.
Critical database operations are structured to avoid partial message and evidence writes when a transaction fails.
RFC 3161 timestamp evidence supports independent verification of when a message or ledger hash existed.
Evidence events can be chained to help reveal tampering and preserve chronological continuity.
Evidence-package assembly may be attested by a SendSecure-controlled service without misrepresenting that attestation as a user signature.