An encrypted workspace for organizations
Mail, calendar, contacts, files and documents. Your content is encrypted on your devices under many separate keys, so our servers store data they cannot read, and most keys open only a small part of it. Your organization decides who holds the keys that open more.
Faral is in invite-only testing. It is developed and hosted in the Netherlands.
Why Faral exists
The threat has changed
AI is making attacks cheaper. Finding a vulnerability, writing an exploit or running a convincing phishing campaign used to take skilled people time. Increasingly it takes a model and a budget. More attackers can try more targets, and they get further. We think every organization should plan for a breach rather than hope to avoid one.
Most workspaces aren’t built for that. The provider’s servers can read every mailbox and every file, so one breach, whether of the provider, an administrator’s account or a single server, can expose a whole organization at once. The damage a breach can do, its blast radius, is as large as it can be.
Faral is built to keep that radius small. Content is encrypted before it leaves your device, keys are divided so that each one opens as little as possible, and they are held by your organization and its people, not by us. Encryption won’t stop every attack. It decides how much an attack can take.
Our approach
What we build for
A small blast radius
Every file and folder, every shared mailbox and calendar, and every conversation has its own key. Mail and your other content use separate keys. Keys are stored encrypted by a separate service and opened in your browser, never on our servers. A key that leaks opens one thing, not everything.
Segmented control for organizations
Organizations decide who can open what. Access to shared mailboxes, calendars and folders follows departments and groups, and changes are previewed before any keys change. When someone loses access, the keys they held are replaced. The organization’s key is generated in an administrator’s browser, and Faral never holds it.
Autonomy and privacy for people
Your keys are protected by your password, which never leaves your device. If your organization can recover your account, Settings tells you so. Mail uses OpenPGP and documents export to .docx and .xlsx, so your data isn’t tied to Faral. And we say exactly what our servers can see.
In practice
What a breach would expose
No system survives every compromise. This is what each kind would give an attacker in Faral today, including the cases where the answer is uncomfortable.
| If an attacker gets | They get |
|---|---|
| Our databases and file storage | Encrypted content and encrypted keys, which they can’t open. Metadata, which they can read: names, email addresses, subject lines, file names and calendar times. |
| Control of our application servers | No access to the key service’s database. They could, however, change the code our servers send to browsers, and capture the keys of people who sign in until that is noticed. Every service that encrypts in the browser has this weakness. |
| One file or folder key | That file, or that folder and what is in it. |
| One shared mailbox key | The mail encrypted under that version of the key. It is replaced when a member loses access. |
| One person’s password and second factor | What that person can open. |
| An administrator’s account | The organization key, which can open members’ accounts and shared mailboxes and calendars. Administrator accounts are the most sensitive part of an organization. Requiring a second factor for all of them is coming next. |
The security model describes the keys, what stays readable and why, and the outside services involved.
Products
What is in Faral
Everything below runs in the browser. Faral is in testing, so “available” means usable by invited testers, not finished.
End-to-end encrypted between Faral users. Encrypted to other PGP users when their key can be found, or sent as a password-protected message. Mail from outside is encrypted when it arrives. Custom domains, aliases and shared mailboxes.
AvailableDrive
Every file and folder has its own key. Share folders and files with colleagues to view or edit, or with anyone through a link that can have a passphrase, an expiry date and a download limit.
AvailableDocs and Sheets
A document editor and a spreadsheet editor, encrypted like any other file in Drive. Imports and exports .docx, .xlsx and CSV. Page layout currently needs Chrome or Edge.
AvailableCalendar
Event descriptions and locations are encrypted to every attendee. Titles, times and attendees are not. Invitations to people outside Faral are sent once; updates and cancellations don’t reach them yet.
Early versionContacts
Phone numbers, addresses and notes are encrypted. Names and email addresses are not, so they can be used for autocomplete. Colleagues appear automatically.
Early versionChat and calls
Channels, direct messages and threads, each conversation with its own key. Voice and video calls are end-to-end encrypted with a key derived from the conversation. Available to organization accounts.
Early versionAmal
An assistant that finds and drafts mail and plans events. When you ask it something, the text it works with is decrypted in your browser and sent to Mistral AI in France. Nothing is sent unless you ask. AI can be turned off: by administrators for an organization, or by you in Settings for a personal account.
Early versionApps
A desktop app for macOS is in development. Phone apps, and connecting existing mail and calendar apps, are planned.
PlannedStatus
Where Faral is today
Faral is in invite-only testing. Before you rely on it, you should know what isn’t built yet.
- Account recovery. If you forget your password, your encrypted data can’t be recovered yet. Recovery with your recovery phrase, and recovery by your organization’s administrators, are what we are building next.
- Moving in. Importing mail, calendars and contacts from another provider is not available yet.
- Administration. Removing a member doesn’t yet clean up everything they had, and there is no audit log yet.
- Apps. Faral runs in the browser. There are no released desktop or phone apps, and existing mail and calendar apps can’t connect yet.
- Review. Faral’s source code is not public yet and has not been independently audited. We will publish it on git.faral.io.
Infrastructure
Where it runs
Faral runs on servers rented from Netcup, a German hosting company, in Amsterdam. Mail, files, backups and our source code are all hosted there. We don’t use Amazon Web Services, Google Cloud or Microsoft Azure.
A few outside services are involved, such as Let’s Encrypt for certificates. The security page lists them, with what each one receives.
Open source
What it is built on
Faral builds on open-source projects, and we are grateful to the people who maintain them:
Stalwart for mail, PostgreSQL, NATS, LiveKit for calls, Garage for storage, Ory Hydra for sign-in, OpenPGP.js, Go and Svelte.
Try Faral
We invite testers in small groups. If you’d like to try Faral, or talk about using it in your organization, send us an email.