The cost of not encrypting is documented.
Email is the initial attack vector in 35% of breaches. Per-record costs run highest in healthcare ($408) and finance ($217).
Tiered fines start at $137 per record for unknowing violations. Willful neglect tops out at $71,162 per record — and a single misdirected email can include thousands.
Most weren't sophisticated attacks. They were forwarded attachments, replied-to threads, and unsecured forwarders — ordinary email behavior, doing what email does.
Pick your retention posture.
No credit card to start. Vault Zero forgets everything at 30 days; Vault Ledger keeps a 6-year audit trail with a signed BAA. Cancel anytime.
For solo practitioners, founders, and anyone whose inbox carries a few critical messages.
- 10 encrypted messages / month
- 25 MB per attachment
- 30-day expiry & instant recall
- Audit log (last 30 days)
- Email support
Leave no trace. Unlimited encrypted email for any team that doesn't want data lingering after it's delivered.
- Unlimited encrypted messages
- 30 MB per secure message
- Gmail & Outlook extension
- Recall a mis-sent email — revoke the link so it can't be opened
- Zero-retention — content & metadata purged at 30 days
- Instant manual purge — burn a message on demand
- Priority email + chat support
Every disclosure, on the record. For clinics and hospitals that need an audit trail and a signed BAA.
- Unlimited encrypted messages
- 30 MB per secure message
- Gmail & Outlook extension + recall
- Signed BAA included
- 6-year audit ledger — accounting of disclosures
- One-click §164.528 disclosure export
- Content auto-shredded at 30 days
Three steps. No software for your recipients to install.
Write like you always do
Open Gmail or Outlook. Address the recipient, attach files, type your message. The extension lives in your compose window; you don't change anything about how you write email.
Hit Encrypt & Send
One extra button next to Send. Optionally set expiry, password, or forwarding rules before clicking. Your draft travels over TLS 1.3 and is encrypted with AES-256-GCM on receipt — stored only as ciphertext.
Recipient opens in one click
A regular-looking email arrives in their inbox with a View secure message button. Click → verify ownership of their address → decrypt in the browser. No app, no signup. Every open is logged.
The verticals where a leaked email gets expensive.
We're an encryption layer, not a vertical SaaS — but compliance is industry-shaped. Each plan ships with the audit posture, certifications, and contracts your category requires. Pick yours; we'll send the paperwork.
Honest about what we are. (And what we aren't.)
We're not trying to replace your inbox. We're the encryption layer for the messages your inbox shouldn't be carrying in plaintext.
Specifically asked, specifically answered.
If your security or legal team has a question we don't cover here, write to admin@spriggan.ai — we answer within one business day, often with the actual engineer on the thread.
We don't replace your inbox. We add one button to it.
The VaultMail Chrome extension injects directly into Gmail and Outlook compose. Write your email exactly the way you always do — then click Encrypt & Send instead of Send.