Sovereign email means you own and operate the infrastructure your email runs on. Instead of routing messages through Google's or Microsoft's shared servers, Hansel provisions a dedicated SMTP infrastructure behind your own custom domain. Your DNS records (SPF, DKIM, DMARC) are auto-generated from your admin console. Your messages never pass through infrastructure you don't control — and you can take your data and exit at any time using Sovereign Reset.

Yes. Custom domain email is available on Sovereign Pro ($4/month) and all Business tiers. You bring your domain — for example, you@yourbusiness.com — and Hansel provisions the sovereign SMTP infrastructure behind it. The admin console auto-generates the exact SPF, DKIM, and DMARC DNS records you need, with clear setup instructions. Domain health is monitored in real time so you always know its verification status. For teams, Business Essentials and Professional allow you to provision custom domain addresses for every seat across your entire organization from a single admin console.

Hansel uses an intelligent algorithmic routing engine to automatically classify and sort all incoming messages into purpose-built folders: Inbox (verified contacts), Unknown Senders (quarantined until you approve), No Reply (automated transactional emails such as receipts and confirmations), Notifications (platform alerts from apps and services), and Spam (algorithmic junk filtering). This means unknown senders cannot reach your attention by default — you control who has access to your inbox, not an algorithm owned by a third party.

Hansel's backup system serializes your complete email state — all threads, messages, attachments, folder structure, and read/unread markers — into a single encrypted snapshot. Before storage, data goes through a serialization 📧 Gzip compression 📧 encryption pipeline. Every backup is timestamped so you can restore to any prior state. Business Professional adds scheduled automatic backups (daily, weekly, or custom cadence) that run silently in the background, plus an org-wide admin view showing per-user backup compliance rates and storage consumption.

Yes — Hansel-to-Hansel email encryption is actively Building Next. When both the sender and recipient are Hansel users, Hansel will encrypt the outbound email content using the recipient's Wicked Crumbs public key before the message is transmitted via SMTP. The message still travels across standard email infrastructure, but instead of readable content, the email carries an encrypted payload that only the recipient's private key — held exclusively on their device — can decrypt. Standard email infrastructure. Sovereign message content.

Sovereign Reset is a complete exit mechanism built into Hansel. It wipes your local profile data, triggers a server-side cleanup of all associated records, and returns your device to a factory-fresh Hansel state — no residual data, no orphaned records. You'd use it if you're leaving Hansel entirely and want a clean break, or if you need to reprovision your identity from scratch. This is a core design principle: platform dependency should never trap your data. You own your data, and you have a clean, architecturally-enforced way to take it back.

The Hansel Admin Dashboard is a sovereign enterprise command center —a settings page. From a single console, administrators get real-time org health monitoring across every seat, complete email domain management with auto-generated DNS records, a full billing overview, seat lifecycle management, RBAC role assignment, DLP policy enforcement, eDiscovery with legal hold, 365-day immutable audit logs, and message tracing forensics. Everything is on infrastructure your organization controls —a third-party vendor's dashboard you're renting access to.

Hansel uses a four-tier role system. Super Admins have full organizational control — seats, domains, policies, DLP, eDiscovery, billing, and all compliance tools. Department Admins have scoped control over their specific team, allowing delegation without granting root access. Standard Users have no admin privileges and operate their own account only. Read-Only Auditors can view logs, audit trails, and compliance reports but cannot make any changes — ideal for external auditors or compliance officers who need visibility without operational access.

* RBAC roles are an advanced role feature currently in Beta —yet generally available (GA).

Every outbound email passes through Hansel's DLP scanning pipeline before it ever leaves your organization. Administrators configure pattern rules — credit card numbers, SSNs, tax IDs, API keys, custom regex — and assign a policy action per rule. When a pattern is matched, the system can block the email entirely, flag it for manual review, hold it pending approval from a manager, or auto-redact the sensitive content before delivery. Every DLP event is logged with full context — who tried to send what, which rule triggered, what action was taken, and the exact timestampcreating an immutable compliance record.

eDiscovery gives administrators the ability to search, preserve, and export email records for legal, compliance, or investigative purposes. You would need it when responding to legal proceedings (litigation, regulatory investigations), audits, or internal HR investigations. Hansel's eDiscovery lets you search across all organizational email by sender, recipient, subject, message body, date range, and attachment name. You can apply legal holds that freeze specific mailboxes — preventing deletion of relevant messages — and then export findings in PST, MBOX, JSON, or CSV format for legal counsel. Every eDiscovery action is itself logged to the immutable audit trail for chain-of-custody integrity.

Business Professional retains 365 days of immutable audit logs — meaning no user or admin can alter or delete them. Every significant event across the organization is captured: authentication events (logins, failed attempts, device changes), email activity, backup events (created/restored/deleted), administrative actions (user provisioning, domain changes, DLP rule modifications, eDiscovery searches, legal holds applied/lifted), billing events, DLP trigger events, and permission changes. Logs are searchable by user, event type, date range, and severity, and are fully exportable for external compliance reporting.

Standard email logs tell you a message was sent. Message tracing tells you everything that happened to it. Hansel's message tracing shows the full delivery path — every server the message touched, delivery status (delivered, bounced, deferred, rejected), spam filter results and why they fired, SPF/DKIM/DMARC authentication pass/fail results, and the latency breakdown per hop. If a message didn't arrive, message tracing tells you exactly where it stopped and why. If a message looks potentially spoofed, message tracing surfaces the authentication failures that confirm it. Most platforms restrict this level of forensic visibility to enterprise support teams — Hansel gives it directly to your admins.

The core difference is pricing and ownership. Google Workspace requires Enterprise Plus ($30/user/mo) to unlock DLP, eDiscovery, and full audit logging. Microsoft 365 requires E3 or E5 ($22+/user/mo) for comparable compliance tooling. Hansel's Business Professional tier delivers DLP, full eDiscovery with legal hold, 365-day immutable audit logs, and message tracing forensics at $12/seat/month — roughly 40–60% cheaper. Beyond pricing, the structural difference is sovereignty: Google and Microsoft hold your encryption keys, control your data residency, and can lock you out. Hansel's admin console runs on infrastructure your organization controls, and a Sovereign Reset gives you a complete clean exit at any time.

Yes. Organizations can register and manage multiple custom email domains directly from the Hansel admin console. For each domain, the console auto-generates the exact SPF, DKIM, and DMARC DNS records you need, with clear setup instructions that don't require a support ticket or external documentation. Domain health is monitored in real time — you always have immediate visibility into the verification status of every domain your organization uses. This is particularly useful for holding companies, organizations with multiple brand identities, or businesses that have acquired other entities and need to unify email infrastructure under a single admin ledger.

Hansel draws a clear line between capability and credential. Hansel is architecturally positioned to align with SOC 2, GDPR, HIPAA, and other regulated frameworks through its foundational design: device-level encryption boundaries, sovereign data custody, verifiable audit capture, and strict policy enforcement layers. However, specific regulatory certifications are not claimed until formally audited, issued, and publicly documented. What is available today is the architectural baseline — your organization gets the infrastructure controls required to meet those frameworks on day one, with certification status updated transparently as verification milestones are completed.

Business Professional retains 365 days of immutable audit logs — no user or admin can alter or delete them. Every significant event across the organization is captured: authentication events (logins, failed attempts, device changes), email activity, backup events (created/restored/deleted), administrative actions (user provisioning, domain changes, DLP rule modifications, eDiscovery searches, legal holds applied/lifted), billing events, DLP trigger events, and permission changes. Logs are searchable by user, event type, date range, and severity, and are fully exportable for external compliance reporting.

Hansel's Sovereign Reset function directly supports GDPR's right to erasure. When executed, it performs a complete cryptographic purge: local device profiles are securely wiped, server-side serialized records are permanently decommissioned, and associated encryption keys are revoked. No orphaned data, no dormant tenant liabilities, no vendor-held archives remain. For data residency, Hansel's infrastructure model supports deployment configuration and storage routing aligned to the regulatory geography where applicable — meaning your communication data can be processed and stored within the jurisdictional boundaries required by your GDPR mandate.

Hansel's admin console enables a comprehensive set of policy controls that run architecturally —as revocable UI toggles. Operators can mandate 2FA across all seats, set password complexity baselines, enforce session timeouts, define email retention windows, configure DLP redaction policies, and scope per-department overrides. These policies are enforced at the infrastructure layer and generate tamper-evident audit trail entries for every enforcement action, providing verifiable proof that your compliance posture is actively maintained.

Hansel's Business Professional tier delivers DLP pattern blocking, eDiscovery with legal hold, 365-day immutable audit logs, and message tracing forensics as built-in capabilities bolt-on add-ons. For many regulated SMBs and mid-market organizations, this replaces the need for separate compliance monitoring tools or expensive enterprise tier upsells from Google or Microsoft. For organizations with existing SIEM or compliance platforms, Hansel's exportable, machine-readable audit logs (with full metadata preservation) are designed to integrate cleanly into those workflows.

Shared cloud platforms create a structural compliance gap: the vendor holds your encryption keys, controls your data residency, and can modify platform terms retroactively. This means your compliance posture depends on their promises, not architectural guarantees. Sovereign infrastructure eliminates this dependency. With Hansel, your encryption keys never leave your devices, your audit trail is cryptographically tamper-evident, your policies run at the infrastructure layer, and your data can be exported or purged on your terms. Compliance becomes a verifiable architectural property —a vendor attestation you have to trust.