a newish email option: cirrux

The other day an internet acquaintence who I appreciate following posted about a new email and workspace option fully hosted in the EU called Cirrux. It looked interesting but it's also new enough that I'd love to have seen more about it and (as you can see from the Mastodon thread) I decided to email the founder a few questions. He gave me permission to share his response here.

Hello! Someone shared a link to Cirrux on Mastodon and I clicked and was intrigued but was also left wanting a bit more in regards to information. The person that shared the link shared some hestiation as well so I thought I might send through some questions regarding Cirrux to try and get a better idea of what it’s about (especially since you invite questions on several pages on your site!). For context, I currently use a mix of iCloud and Fastmail but don’t love that my data is all hosted stateside and that encryption isnt necessarily zero access (or present or guaranteed). Also if you respond I was wanting to publish it on my website (https://krrd.ing - it’s not a high traffic website) in case there are others out there with questions (like my friend and I on Mastodon), if that would be ok with you. The format would be this intro note with the below question and your answer.

questions

Indeed one man show today. It will for sure grow a bit beyond me and I have a crew of folks around me already that help on contractor basis (eg for security audits). Also have the structure in place to offer code-escrow contracts, currently only doing that with larger orgs since there's a pricetag. But that would mean they will get source-code access automatically whenever something happens to me or the company.

I've been writing software for 20 years. Last year, everything changed, because now I suddenly am able to dispatch agents that do the tedious parts for me, which saves me a ton of time and allows me to spend most of my time on architecture, structure and product. So I love it and it allows me to do much more. But I'm in the lead and I'm spending a lot of time auditing what AI produces. I find that AI is really bad at setting direction and I dislike most of the writing AI does, so those are the things I do myself :)

I actually have extensive filtering options in the product! It's not directly sieve but it has most of the features it usually offers + a few more that are normally not part of sieve: https://cirrux.co/help/mailboxes (it's on this page but that is definitely underselling what is present in the product so I should improve that). One fun addition I added a while ago is filtering newsletters and setting an action to auto-archive emails in 30 days. The combination of those two helps clean up my inbox automatically.

I just started testing the Calendar web client with Superfans (some users opt in to support the project a bit more). It's already in a pretty good shape. My previous startup was Rise Calendar, so I know a thing or 2 about building calendars haha. You can read about our journey here: https://risecalendar.com/. Secret sauce for all my clients: they are all local first, built for speed and keyboard first. I'm taking a pretty minimal approach with the clients, especially because if you want a more traditional one you can simply connect to those because Cirrux supports those open protocols as well. The secret sauce for the whole platform is that it is completely custom architecture, both for those clients as well as the SMTP/IMAP/CalDAV/CardDAV server. I wrote the foundation of those pre-AI, initially to learn more about those protocols but they are pretty solid now.

I'm doing a few things in terms of sustainability already, like investing a bit of every subscription and relying on a hosting party that runs their datacenters for 100% on renewable energy. I'm committed to continue doing that and always curious if I can do more.

Email on Cirrux is encrypted at multiple layers, and keys are spread over multiple systems so someone needs access to multiple systems to gain access. User data is further secured by using workspace-scoped keys, so if those keys are deleted (when you delete your account), the data can no longer be read. I have admin tools to help troubleshoot, and all those actions are logged and traceable. I'm also working towards getting ISO 27001 certified (amongst other certifications) to make this even better. There are other platforms that are deeply focused on end-to-end everything, and if that's something you care about, I'm recommending those (like Proton). For me, the impact on UX, especially in a team context, is too big, so in Cirrux I'm taking a slightly more pragmatic approach. The Cirrux Backup solution I'm offering separately (which copies and syncs a Google account to have a secure copy) is actually end-to-end encrypted: the Desktop App generates an on device key pair and only shares the public key with Cirrux to encrypt your emails, after that they can no longer be read by anyone except you. Full technical details here: https://cirrux.co/help/encryption.

Yep, status page is here: https://cirrux.betteruptime.com/

On deliverability: that's obviously top priority for me. Just like stability of the product is. So that's why I'm keeping a really strict 0-bugs rule: issues always get prioritized before new features. Email deliverability comes down to reputation a lot, next to having your tech in order. And the best way to guard that reputation is by not allowing free accounts. Next to that I have a lot of monitoring in place to keep an eye on things as they happen. And I think it's just really nice that I'm just a guy you can reach out to, try that at one of the big players ;)

JMAP is a solution to a problem that doesn't really exist, honestly. Which is why mainstream clients haven't adopted it and I also don't see myself focusing on it in the near future. My IMAP implementation is really fast, and for an even better experience you can use my own client.

Attached a few screenshots of Mail, Drive and Calendar!

my takeaways

I like a lot that Rick is approachable. It means something that he took the time to respond. I'm a nobody on the internet but I appreciated that he engaged.

In terms of what I was wondering about:

• I feel some assurance that he's at least thinking about the future. I think this can be a hard thing in founder scenarios or one man shops but it's nice to know security audits have been contracted (amongst other things) and that there's been thought to the "what if a bus happens" question (although the code escrow doesn't affect me).
• AI - this is probably my biggest hangup; I was really glad to read on in the questions that the core backend functions were written pre-AI but it does seem like a lot of the code base does lean into it; I'm not totally against this but it does give me pause in core arenas like email/calendar/contacts.
• I missed filtering in the helpdocs when I first read through (I was looking for it as a major category because that's how important it is to me). I'm glad it's there though and matters to him!

my plans

Cirrux is a compelling product. As I wrote in my initial email to Rick, I don't love hosting email on iCloud and even Fastmail gives me slight pause at times. Cirrux could be a possible replacement:

• It's priced very reasonably: 29 euro/year/account for 20GB beats Fastmail, depending on your needs.
• I also appreciate quite a bit Rick's approach to encryption in Cirrux: it's obviously important and baked in but not the thing that defines the service.

My omglol discount with Fastmail is up in October and right now Cirrux is sitting at the top of the list of potential replacements, should I choose to replace it. I'll definitely be keeping an eye on how it progresses and might consider testing with a random domain closer to October.