VaultMail
Sign inAdd to Chrome
HIPAA-safe encryption · Signed BAA · AES-256-GCM

It's still Gmail.
Just encrypted.

VaultMail adds one button to your Gmail or Outlook compose window. Hit Encrypt & Send instead of Send and your message goes out end-to-end encrypted — with a self-serve BAA, an audit log, and recipient access you can revoke any moment.

Works in Gmail & Outlook
Recipient opens in one click
Self-serve BAA, signed in 60s
Revoke access any time
Full audit log
AES-256-GCM end-to-end
Free for individual providers · No credit card required
🔒mail.google.com/mail/u/0/#inbox
Gmail
🔍 Search mail
J
📥
📤
📁
G
Google Workspace SupportRe: Account recovery — ticket #SR-4982— Hi John, thanks for sending over the docs. Reviewing now and will…10:42
S
Sarah ParkQ3 board materials — for review before Tuesday— Marcia — sharing the board pack ahead of Tuesday. Includes the…9:18
A
Atlas Health BillingPatient records request — Garcia, Maria— Per our conversation, attaching the requested records for Maria…Yesterday
L
Lumen LegalNDA countersigned — Acme acquisition— Counter-signed copy attached. Originals to follow by courier.Tue
C
Chase & PartnersWire instructions — closing escrow— Confirming the wire instructions for the Tuesday closing. Account…Mon
New Message×
Auto-encrypt: ON
FromJohn Chen <john@spriggan.ai>
Tosupport@google.comCc   Bcc
Account recovery — verification & backup codes attached
Hi team,

Per your request, I'm attaching the verification documents and backup recovery codes for the workspace audit (ticket #SR-4982). Please treat as confidential — sending via VaultMail.

Let me know if anything else is needed before the call on Thursday.
📎recovery-codes.pdf· 28 KB
📎verification-ID.jpg· 1.4 MB
↶ ↷Sans Serif ▾tT ▾BIUA ▾≣ ▾
Aa🔗🗑
Sealing PHI, M&A docs, and privileged correspondence at
Atlas HealthWexford Legal
C&PChase & Partners
MERIDIAN/COLumenNorthstar Bio
§ The cost of plaintext

The cost of not encrypting is documented.

We didn't invent these numbers. They come from the FBI, IBM, and HHS — a category of incident plain email enables and a category of cost VaultMail erases. The math isn't subtle.

$4.88M
Average cost of a data breach, 2024
src · IBM Cost of a Data Breach Report

Email is the initial attack vector in 35% of breaches. Per-record costs run highest in healthcare ($408) and finance ($217).

$1.5M
Annual HIPAA penalty cap, per violation category
src · HHS / 45 CFR §160.404

Tiered fines start at $137 per record for unknowing violations. Willful neglect tops out at $71,162 per record — and a single misdirected email can include thousands.

2.6B
Personal records exposed in publicly-disclosed leaks, 2024
src · ITRC Annual Data Breach Report

Most weren't sophisticated attacks. They were forwarded attachments, replied-to threads, and unsecured forwarders — ordinary email behavior, doing what email does.

§ How it works

Three steps. No software for your recipients to install.

New message · Gmail— ⤢ ×
Toalex@protonmail.com
SubjectQ3 financials — signed
Attaching the signed Q3 statements plus the appendix Marcia asked about. Treat as confidential.
STEP 01

Write like you always do

Open Gmail or Outlook. Address the recipient, attach files, type your message. The extension lives in your compose window; you don't change anything about how you write email.

Compose window · bottom bar
VAULTMAIL INJECTION
STEP 02

Hit Encrypt & Send

One extra button next to Send. Optionally set expiry, password, or forwarding rules before clicking. Encryption happens locally — your draft never leaves the machine in plaintext.

FROM11:42
You shared a vault
vaultmailapp.com/v/8fK2-…
Vault opened
● LOGGED
STEP 03

Recipient opens in one click

A regular-looking email arrives in their inbox with a View secure message button. Click → verify ownership of their address → decrypt in the browser. No app, no signup. Every open is logged.

§ Built for

The verticals where a leaked email gets expensive.

We're an encryption layer, not a vertical SaaS — but compliance is industry-shaped. Each plan ships with the audit posture, certifications, and contracts your category requires. Pick yours; we'll send the paperwork.

Healthcare & clinics

Patient records, imaging, intake forms, treatment plans, referrals. BAA included on every paid plan.

HIPAA · 45 CFR §164.312

Law firms

Privileged correspondence, draft pleadings, discovery, e-signed engagement letters, M&A working papers.

NDA-grade · revocable

Finance & accounting

K-1s, term sheets, board materials, audit working papers, KYC packets, IRS notices.

AES-256-GCM · Audit log

Founders & operators

Trade secrets, investor decks under embargo, exec correspondence, severance, board minutes.

NDA-grade · revocable

HR & talent

Offer letters, compensation packets, performance reviews, separation agreements, immigration paperwork.

Per-recipient expiry

IT & security teams

Credentials, vendor contracts, recovery codes, incident response — the internal email category most likely to leak the company itself.

Revocable · fully audited
§ Where we land

Honest about what we are. (And what we aren't.)

We're not trying to replace your inbox. We're the encryption layer for the messages your inbox shouldn't be carrying in plaintext.

VaultMail
● THIS PRODUCT
Plain email
Generic E2E mail
Enterprise suite
End-to-end encryption
Recipient opens without an account
Per-message expiry & revocation
Append-only audit log
Signed BAA (HIPAA)
Self-serve, free
$$$ add-on
Works inside Gmail / Outlook Web
Outlook only
File attachments up to 5 GB
25 MB cap
100 MB
Varies
Time to send your first encrypted message
< 60s
instant
10-20m setup
weeks
Per-seat cost, 10-seat team
$8/mo
Free
$10-15/mo
$25-60/mo
Comparisons reflect published feature sets as of May 2026. "Generic E2E mail" averages ProtonMail / Tutanota. "Enterprise suite" averages Virtru / Paubox / Zix.
§ Pricing

Free until it's load-bearing.

No credit card to start. Self-serve BAA (sign it yourself from settings) on every paid plan. Cancel anytime.

Individual
Free

For solo practitioners, founders, and anyone whose inbox carries a few critical messages.

Start free
  • 10 encrypted messages / month
  • 25 MB per attachment
  • 30-day expiry, revocation
  • Audit log (last 30 days)
  • Email support
Most popular
Team
$8/ user / mo

For practices, firms, and teams sending PHI, privileged correspondence, or financial documents at scale.

Start 14-day trial
  • Unlimited encrypted messages
  • 5 GB per attachment
  • Self-serve BAA, signed in 60s
  • Recipient groups & SSO
  • Full audit-log export
  • Priority email + chat support
Enterprise
Custom

For hospitals, law firms, and finance teams with custom residency, deployment, and audit requirements.

Talk to sales
  • Everything in Team, plus —
  • SCIM provisioning
  • EU / US data residency pinning
  • On-prem key management (BYOK)
  • Custom DPA & SLA
  • Dedicated solutions architect
Volume discounts at 50+ seats · Annual billing saves 16% · See full pricing details →
§ Questions

Specifically asked, specifically answered.

If your security or legal team has a question we don't cover here, write to security@spriggan.ai — we answer within one business day, often with the actual engineer on the thread.

No. The Chrome extension injects directly into Gmail and Outlook compose — you write the email the way you always do, then click Encrypt & Send instead of Send. The recipient gets a normal-looking email with a 'View secure message' link. For Apple Mail, Yahoo, Proton, and other clients, use the standalone Chrome popup.

§ How it lives in your inbox

We don't replace your inbox. We add one button to it.

The VaultMail Chrome extension injects directly into Gmail and Outlook compose. Write your email exactly the way you always do — then click Encrypt & Send instead of Send.

● PRIMARY SURFACE

One orange button. Same Gmail.

Write your message in Gmail like you always do. Address it, attach files, hit Encrypt & Send. The extension wraps everything in end-to-end encryption locally — your draft never leaves your machine in plaintext.

  • Auto-encrypt toggle for entire conversations
  • Per-message expiry from 24h to 30d
  • Encryption happens locally — keys never touch our servers
  • Force-install via Google Workspace / Microsoft 365 Admin
New Message×
Auto-encrypt: ON
FromJohn Chen <john@spriggan.ai>
Tosupport@google.comCc   Bcc
Account recovery — verification & backup codes attached
Hi team,

Per your request, I'm attaching the verification documents and backup recovery codes for the workspace audit (ticket #SR-4982). Please treat as confidential — sending via VaultMail.

Let me know if anything else is needed before the call on Thursday.
John Chen
Head of Security · Spriggan
📎recovery-codes.pdf· 28 KB
📎verification-ID.jpg· 1.4 MB
↶ ↷Sans Serif ▾tT ▾BIUA ▾≣ ▾
Aa🔗🗑
VaultMail
mankarisagar@gmail.com
Vault unlocked
Drop files here
or browse
alex@protonmail.com
Expires30d
ForwardingOff
Encrypt & generate link
SECONDARY · FOR EVERYTHING ELSE

Not in Gmail? Use the popup.

For Apple Mail, Yahoo, Proton, internal webmail, or sharing a file outside of email entirely — the standalone Chrome popup gives you the same encryption with a drag-and-drop interface. Same backend, same audit log, same keys.

  • Drag files up to 25 MB into the popup
  • Copy a share link straight to clipboard
  • Works in any browser tab — no email client required
  • Same recipient experience as the Gmail flow