Apps

Each product holds its own key. A key scopes every request to that app’s own rows — one product cannot read another’s mail by being on the same box.

Keys are stored hashed. The plaintext is shown once, when the app is created, and cannot be recovered — a lost key is replaced, not retrieved.