Factual disclosure for the Iris Mail beta at iris.fluidprism.com. Not marketing copy.
Encrypted end to end: a message to exactly one person (no Cc or Bcc) who has Iris, sent from a browser that holds your key. The body and attachments up to 6.5 MB are sealed in your browser with the recipient's public key before they leave it, so mail-sync-service and Cloudflare cannot read them. Larger files are encrypted in your browser and shared by link; the file key stays in the part of the link after the # sign, which is never sent to a server. The recipient's key must be pinned, or verified after a change.
Signed, not encrypted: everything else. That means anyone who is not on Iris, a message with more than one recipient, any Cc or Bcc, and a message sent from a browser that does not hold your key. Iris signs it where it can. mail-sync-service handles it in readable form while it builds and submits the message to Gmail or Microsoft, and Cloudflare, which carries the traffic, can see it.
What encryption does not hide: who a message is from and to, when it was sent, and its subject.
Requests to iris.fluidprism.com terminate TLS at Cloudflare's edge before reaching our origin. That means Cloudflare can see request metadata and any content that is not already E2E-sealed in the browser. E2E sealed bodies remain ciphertext through the edge; signed (not encrypted) bodies are plaintext at the edge and at the origin.
Linking a second browser requires both devices to display and compare a 6-digit short authentication string (SAS) derived from both public keys and the pairing code. The existing device seals the long-term identity secret only after a human confirms the codes match. Signing in with a QR code works for personal and team accounts: the new browser shows a code, and a phone that is already signed in to Iris scans it and approves.
Email security@fluidprism.com. See also security.txt.