Every time you add an email account to a cloud-based client, you’re making a decision that often goes unconsidered: you’re trusting that company’s infrastructure with the keys to your email. If they’re breached, your credentials are exposed. If they change their terms of service, your data is affected. If they go offline, you lose access.

cji.email was built around a different premise: your email credentials should live on your machine, encrypted by your operating system, and never leave.

Why Cloud Credential Storage Is a Structural Risk

Cloud-synced email clients store your IMAP and SMTP passwords (or OAuth tokens) on their servers so they can sync your email from any device. This is convenient, but it concentrates risk. One breach at the provider exposes credentials for every user. The history of cloud service breaches is long and still growing.

There’s also a subtler issue: you rarely know what a cloud email client does with your credentials on the backend. Is the token encrypted at rest? Who has access to the encryption keys? Is the token scope limited, or does it grant broad access to your account?

With cji.email, you don’t need to answer those questions, because the credentials never reach a server we control.

OS Keychain Integration: How It Works

Modern operating systems provide a secure credential store designed specifically for this purpose:

  • macOS: the macOS Keychain, optionally backed by the Secure Enclave on Apple Silicon
  • Windows: Windows Credential Manager, backed by DPAPI and optionally by TPM
  • Linux: libsecret, integrating with GNOME Keyring or KDE Wallet

cji.email uses Tauri’s secure credentials API, which calls these native stores directly. When you add an email account, the IMAP password or OAuth access token is stored in the OS keychain — not in cji.email’s configuration files, not in a database cji.email manages, and not on any server.

When cji.email needs to connect to your IMAP server, it requests the credential from the OS keychain at connection time. The credential is held in memory only for the duration of the connection, then released.

What Hardware-Backed Security Means

On devices with a Secure Enclave (Apple Silicon Macs, many recent Windows machines with a TPM), keychain entries can be bound to the hardware itself. This means the encrypted credential material cannot be extracted from the machine, even with root access or physical possession. The decryption happens inside the secure hardware, not in software.

This is a meaningful security property. An attacker who gains access to your filesystem — through malware, a backup, or physical access — cannot extract your email credentials from the keychain without also satisfying whatever authentication policy protects the keychain entry (your system password, Touch ID, or Windows Hello).

OAuth2 Tokens and Scope Limits

For Gmail, Outlook, and other accounts that use OAuth2, cji.email requests only the IMAP and SMTP scopes — the minimum access needed to read and send email. It does not request access to your calendar, contacts, Drive, or any other Google or Microsoft service.

The token is stored in the OS keychain. If you revoke cji.email’s access in your Google or Microsoft account settings, the token becomes invalid immediately and cji.email will prompt you to re-authenticate.

Local Email Cache: IndexedDB and Offline Access

Credentials are just one part of the local-first picture. cji.email also caches your email locally, so you can read, search, and draft messages without an internet connection. The local cache uses an embedded database managed by the Rust backend.

This has practical benefits beyond privacy: search is fast because it runs against local indexes, not a server. Loading a message you’ve already seen is instant because it’s already on disk. The IMAP server is consulted only for new messages and for operations that need to be synchronized (moves, deletions, flag changes).

The Accountability Gap This Closes

With traditional cloud email clients, you have to trust the provider’s infrastructure, their security practices, their employees’ access controls, and their continued operation. With cji.email, the security posture of your email credentials is determined by your operating system’s keychain implementation — something designed, audited, and maintained by the people who built your OS, with threat models that include well-funded adversaries.

That’s not a small difference.