Triunnia Labs

Every Email, Encrypted and Accountable

The Email Api is Arch's centralized transactional email service. It stores email addresses under per-record encryption, sends templated messages through your configured provider, and manages the complete verification lifecycle — your application works with email through a single authorized interface and never has to own the stack beneath it.

Encrypted at the Record Level

No Two Email Addresses Share a Key

Per-Record Encryption

Most databases encrypt their storage at the volume level — one key protects every row. The Email Api applies a distinct encryption key to every email address it stores, sourced from the Keys Api. A breach of the database yields ciphertext. An attacker who wants twenty addresses must break twenty independent keys.

Hash-Based Lookup

The Email Api computes a SHA-512 hash of each address and uses that hash for all search operations. The raw address travels only on record creation and retrieval — and always inside an encrypted envelope. The system has no plaintext lookup path.

Send Without Managing SMTP

One API Call Delivers the Email

Provider Abstraction

Applications send emails by calling the Email Api with a template name and parameters. The underlying provider — currently Postmark — is a configuration detail your microservice never has to know. Switch providers, rotate credentials, and reconfigure delivery settings in the Control Panel, with no changes to application code.

Template-Driven Delivery

Emails are sent against pre-defined templates registered with your provider. The Email Api passes the template identifier and parameters; the provider handles rendering. This keeps presentation out of your service layer and gives marketing teams ownership over email content without a deployment cycle.

Verification Built In

From Registration to Confirmed Inbox in Two API Calls

Token-Backed Verification

When an application needs to verify an email address, a single call to the Email Api initiates the workflow. It creates a time-bound token through the Tokens Api, sends the verification email, and waits. When the user clicks the link, a second call validates the token and marks the address confirmed. Your application never has to manage token generation or email construction — both are handled server-side.

Delivery Intelligence

The Platform Knows When an Address Turns Bad

Automated Bounce and Complaint Handling

The Email Api registers as the webhook receiver for your Postmark account. When a delivery bounces or a recipient marks a message as spam, Postmark notifies the service directly, and the address is flagged automatically. Your email list stays accurate without manual intervention.

Status-Aware Sending

Each email record carries its delivery history — verified, bounced, abused, and banned states are tracked per address and returned in every lookup response. Any workflow that sends email can check the address status first. The Email Api never dispatches to an address the platform already knows is unreachable.

Connected by Design

Email Is One Service in a Coordinated Stack

Verifying Users

Onboarding a new user through email verification calls three services in sequence — the Email Api handles delivery, the Tokens Api provides the time-bound token, and the result flows back into the user record. Each service owns one responsibility.

Your Notifications

Any microservice registered with Arch can call the Email Api directly. Transactional emails — confirmations, alerts, receipts — are sent through the same encrypted, authorized channel.