Insights

Notes from the build floor.

How we think about privacy, infrastructure, and shipping. The thesis behind the work — sanitized so we can talk about it without exposing client systems.

Get new posts in your reader of choice — subscribe instructions.

Operations2026-09-065 min read

What falls outside a managed IT contract

Contracts specify activities; you need outcomes. Three findings from our own audit that a contract being honored to the letter would have covered.

Operations2026-09-065 min read

Why one practice answers an audit in a day

Measured timings for audit-shaped questions against our own systems, and the three we could not answer. The difference is recording, not diligence.

Operations2026-09-065 min read

A renewal that would have failed silently

Two correct decisions combined into a certificate renewal that would have failed silently, and the check that catches the causes nobody predicted.

Operations2026-09-065 min read

Testing a backup takes four minutes

A restore test of our own mail backup, and the two things beyond the data that decide whether a restore actually produces a working system.

Operations2026-09-065 min read

A check that has never passed is not a check

A monitor on our mail domain failed every day for four months while the thing it watched was healthy. The question worth asking of every check you own.

Architecture2026-04-2711 min read

What plausible deniability means in our architecture

We named the company after a phrase. Most privacy products sell hiding; we sell unreliability. What that buys, and the lines we will not cross to ship it.

Engineering2026-04-2710 min read

Why we're building Thundercrab

Consumer mail clients replaced an open filtering standard with ML categorization nobody can read, edit or carry between providers. We build the alternative.

Architecture2026-04-279 min read

Provable-by-construction privacy

Two ways to promise to protect data: a policy you trust, or a property the type system enforces. We pick the second where the engineering allows.

Operating Model2026-04-277 min read

How a written-down doctrine changes what "shipping" means

We wrote our taste down. Every public function carries a BUG ASSUMPTION annotation, every defense a SECURITY annotation, and CI enforces both.

Architecture2026-04-268 min read

Federated rule learning, without ever reading your mail

How sorting rules get smarter from the collective without any provider — us included — ever seeing message content. What we built, and why it matters.