Trust nothing.
Verify, then deliver.
ZTPipe is a dedicated pipe for zero-trust messaging. It trusts neither the route, nor the servers, nor the name a sender claims. Content is encrypted on the sender's device, and every message is checked on the recipient's device for who sent it and whether it was altered before it is delivered. Contracts, invoices, HR, engineering: keep the exchanges your business depends on in a pipe of their own, apart from everyday email.
Never trust because of location or a claimed name. Verify every exchange.
Only verified messages flow through it and reach your Trusted Inbox.
macOS · Windows / Microsoft 365 · Google Workspace (coming soon) · IMAP / ¥800 per license · 30 days (excl. tax)
Zero trust,
applied to messaging.
Zero trust means never granting trust because of where something sits or who owns it, such as “it's inside our network” or “it's a server we know”, and instead verifying the other party and the content every time.
Email has always relied on trusting something along the way: the route, the mail servers, the cloud inbox, and the sender's claimed name. ZTPipe trusts none of them. It anchors trust in keys and signatures instead of location, and verifies every single message.
That is why it is called ZT (Zero Trust) Pipe: a second pipe through which only verified communication flows.
Important mail gets buried.
You dig for the mail you need among newsletters, notifications and ads, while convincing impersonations sit right beside it, looking just the same.
Only the exchanges your work needs.
Only verified exchanges with people you have swapped keys with. Mail that merely claims a name never gets in.
Why messaging needs zero trust.
Email is convenient and reaches everyone. The price is that it has always worked by trusting the route, the servers and the sender's claimed name. With data breaches and attacks in the news every week, the more important the exchange, the more it is time to rethink that assumption.
Don't trust the route or the servers
Email passes through intermediate servers and cloud inboxes, and stays there. If it is stored in readable form, a misconfiguration or unauthorized access exposes the content. So the content stays encrypted from device to device.
Signed in, but still unreadable
When someone gets into a cloud email account, they can usually read every message and attachment in the inbox. ZTPipe messages can only be opened on a device that holds the key.
Don't trust a claimed name
Emails posing as real companies or executives, text made fluent by AI, fakes that pass sender-domain authentication. Instead of the display name, ZTPipe verifies keys both sides have compared, and signatures.
Don't trust the files
Instead of password-protected ZIP files, send directly, encrypted to the recipient's key. Attachments are checked separately even when signed, and no readable copy is left behind in a cloud file store.
Important mail gets buried
Newsletters, notifications and sales mail from every site and service you have signed up for. Searching for the mail you need costs time every day, and breeds both missed messages and a lowered guard against impersonation.
Hence, Zero Trust Pipe
Assume nothing can be trusted: protect the content, verify the sender and integrity, and deliver only what has been verified. A second pipe that carries only the exchanges your work needs.
From sending to delivery: four stations.
Seal
The message is signed on the sender's device and encrypted to the recipient's key. Private keys never leave the device. If a recipient's key is missing, ZTPipe never falls back to sending in plaintext.
Carry
Delivery uses the email service you already have. Mail servers and the cloud only ever hold ciphertext, which ordinary email apps cannot open.
Verify
On the receiving device, the message is first quarantined, then decrypted and checked: signature, sender's key, integrity. Attachments are checked separately for type, format and by your antivirus software.
Deliver
Only messages that meet every condition reach the Trusted Inbox. Anything that cannot be verified is never treated as “OK”: it is set aside for review, with the reason shown.
Signed or not,
attachments are checked separately.
A signature shows who sent a message and that it was not altered on the way. It does not mean a file is safe. Before an attachment is opened, ZTPipe checks it on a separate path from the signature, one file at a time. Results distinguish “clean”, “problem found” and “could not be checked”, and anything that could not be checked is never reported as clean.
Executables, scripts and other dangerous file types are never opened.
Files whose real type does not match their extension or declared format are not opened.
Office macros, external templates, DDE and embedded objects, and PDF JavaScript, auto-actions and external references are detected, reported and blocked.
ZIP and other archives are held to limits on extracted size, number of files and nesting depth.
Zero-width and direction-changing control characters, and hidden text, sheets and rows in documents, are found and shown.
Calls the device's antivirus or EDR to scan the file and checks its response. If no scan is possible, the file is marked “not scanned” and opens only after confirmation.
Attachments never open automatically, and external images and links are never loaded. Message bodies are shown as text only.
Saved files carry a mark that tells the operating system they came from outside.
Where it fits.
Invoices, payments, changes of bank details
Against schemes where an email posing as a supplier or executive asks you to change payment details. Only messages signed with a supplier key you have compared reach the Trusted Inbox; mail that only claims a name does not.
Board and management meeting papers
Against leaks from inboxes and shared links. Content opens only on the recipient's device, and password-protected mail asks for the password every time.
Contracts and draft clauses
Against mixed-up versions and tampering. Verify integrity, and add timestamp proof when needed so you can later verify when a document existed.
Payroll, reviews, personal data
Nothing can be sent to unknown addresses, and what should not linger in an inbox can be sent as expiring mail, deleted from both ZTPipe apps after the deadline.
Quotes, orders, price lists
Against fake orders and prices rewritten in transit. The sender and content are verified by signature before anything is shown.
Drawings, specifications, contractors
Against leaks from contractors or cloud file stores. Exchange directly with contractors, ZTPipe to ZTPipe. Attachments are checked separately from the signature.
Lawyers, tax advisors, accountants and their clients
Instead of password-protected ZIP files, send directly, encrypted to the key. Hand over confidential documents without creating a place to store them.
Important messages from clients and colleagues
Not buried under newsletters and notifications: open it and see only what your work needs. Organize with folders, rules, flags and templates.
What we protect
- Message bodies and attachments open only in the sender's and the recipient's ZTPipe. Mail servers and the cloud hold only ciphertext.
- Senders are verified by signature and by keys both sides have compared. Display names are not trusted.
- Verification comes before display. Nothing that cannot be verified or checked is reported as “OK”.
- Private keys never leave the device. Neither the portal nor the license server handles message bodies, attachments or keys.
What we do not promise
- A signed message is not guaranteed to be free of malware.
- Timestamp proof shows when something existed. It does not show who wrote it or that its content is correct.
- Even with expiring mail, content saved, copied or photographed before the deadline cannot be erased.
- ZTPipe does not prevent an email account from being taken over (if it is, the content of ZTPipe messages remains ciphertext).
- If the sender's or recipient's device is compromised, encryption cannot protect the messages.
No new mail server required.
ZTPipe runs on top of the email account you already use and separates only your important exchanges. Newsletters, notifications and mail from unknown senders stay in your usual email app, as they always have.
Pay only for the people who need it.
One license per person (one email address). Add or remove licenses at any time from the portal.
- Up to 2 devices per license
- Currently available only to corporations established in Japan
Frequently asked questions
Does the other party need ZTPipe too?
Yes. ZTPipe messages can only be read between ZTPipe users. You first invite each other, exchange keys and compare them, then start exchanging messages.
Do you store our message content on a server?
No. Encryption and decryption happen on the device, and mail servers receive only ciphertext. The portal and the license server never handle message bodies, attachments or keys.
Does it prevent sending to the wrong person?
Messages cannot be sent to anyone you have not exchanged keys with, so sending to an unknown address becomes unlikely. It cannot, however, prevent you from sending to a different contact you have exchanged keys with.
Can I see the messages in my usual email app?
They arrive in the same mailbox, but the body and attachments appear only in a form that cannot be opened. Mail delivery and the way you use email day to day do not change.
What if I replace or lose a device?
Keys are kept on the device. One license covers up to 2 devices, and a new device is added with a short code shown on a device you already have. If you lose a device, you can remove it from your other device. The removed device cannot read messages that arrive after that. If you lose all of your devices, past messages can no longer be read.
Is timestamp proof required?
No, it is optional. Without it, the core protections (signing, encryption, and verification before display) work exactly the same.
Give your important communication a pipe of its own.
Keep your everyday email as it is. Only your important exchanges, verified before they are delivered.