01
Connect by OAuth.
Each user connects their existing Gmail, Google Workspace, Outlook, or Microsoft 365 inbox in one tap. There are no MX changes, no DNS changes, no quarantine portal to provision. Nothing in your existing mail flow moves.
Independently audited
Founded 2025. Email processing software. Not a payment processor, money transmitter, or custodian.
What this audience is up against.
Numbers from public sources, attributed below each card. None of these problems are hypothetical.
$2.7B
Source: FBI IC3 2024 Internet Crime Report
$4.88M
Source: IBM Cost of a Data Breach Report 2024
68%
Source: Verizon Data Breach Investigations Report 2024
Day one. Five minutes.
No MX changes, no DNS changes, no IT ticket. The deployment is account-level, which is why a 200-seat rollout looks like a 1-seat rollout repeated 200 times.
02
Set defaults for your team.
An admin chooses a default cover charge per inbox and the team-wide rejection note. Each user can adjust their own settings later. The defaults make the rollout boring.
03
Existing contacts walk in.
The auto-scan reads each user’s contacts, sent folder, starred messages, and inbox frequency. Anyone the team has emailed before is on the guest list automatically. New senders see a one-time challenge with bounce-back instructions.
What this means for IT.
Direct answers to the seven questions that show up in every evaluation call. Honest about gaps where they exist.
Outbound email deliverability
Zero impact. Rythm filters incoming mail only. Your outbound traffic, sender reputation, and DKIM signing are untouched.
DNS and MX changes
None required. Rythm reads incoming mail through the provider API after delivery, then files. The mail flow itself does not move.
SSO compatibility
Each user signs in through Google or Microsoft, which means Rythm inherits whichever SSO you already run on your provider (Google Workspace SSO, Microsoft 365 SSO via Entra ID).
Audit logging
Every challenge issued, payment processed, and admin action is logged with a timestamp, user identifier, and correlation ID. Logs are retained 90 days by default and can be exported on request for SIEM ingest.
Data residency
Account metadata and OAuth tokens are stored in AWS us-east-1, encrypted at rest with AWS KMS. Additional regions are on the roadmap; ask if you need a written commitment for a procurement review.
Vendor lock-in
None. Guest list and account data export anytime in CSV. Disconnecting Rythm leaves your inbox exactly the way Gmail or Microsoft already arranged it.
Deprovisioning a departing employee
Admin removes the seat. The user’s OAuth token is revoked immediately and Rythm stops processing their mail. You can also revoke the connection from Google or Microsoft directly without contacting us.
Flat pricing. Same rate at any scale.
$1.65 per inbox per month effective on the annual Lightning option. The same price applies whether you are one inbox or two thousand.
$1.65
per month
Annual on Lightning includes one bonus month. See full pricing.
No volume discounts and no per-seat negotiations. The unit economics make sense at any scale, so we charge the same flat rate for solo founders and 500-person teams. Single-line invoicing, central billing, and procurement-friendly terms are available. Reach us through /contact with the seat count and the legal entity name and we send a single-line invoice the same day.
Compliance and audit.
What we hold today, what we offer on request, and how to reach us if your vendor-risk process is wired to a specific framework. Most of what your security team needs is here so the review can move forward without a follow-up call.
| Document | Status | Detail |
|---|---|---|
| CASA Tier-2 security audit | Completed (39 of 39). | Independent third-party assessment, finalized 2026. The full /security page walks through the test areas: identity, OAuth scope minimization, KMS encryption, SSRF guard, nonce-based CSP, PII redaction, and incident response. |
| Data Processing Agreement (GDPR) | Available on request. | A standard GDPR-aligned DPA is ready for signature. Reach us through /contact with the legal entity name and we send a copy the same day. |
| Sub-processor list | Public. | The current list of sub-processors is published at /legal/sub-processors. Material changes are announced on the blog and the /changelog page. |
| Vendor-risk frameworks | Discuss directly. | CASA Tier-2 is the security audit Rythm holds. If your vendor-risk process is wired to a specific framework (SOC 2, ISO 27001, BAA, or otherwise), reach us through /contact and we will walk through what we can show, including architecture detail at /security and our sub-processor list. |
| Data retention policy | Documented. | Logs 90 days. Account metadata for the lifetime of the account plus 30 days after cancellation. Email content is never stored. Full policy at /legal/privacy-policy. |
| Encryption at rest and in transit | Standard. | AWS KMS for data at rest. TLS 1.2 or higher for data in transit. Per-Lambda IAM roles. Detail at /security. |
Documents and audits are linked where available. For anything that says "available on request" or "case-by-case", reach us through /contact with your legal entity name.
How it actually works.
Rythm is a known-or-pay check at the user account. Each user connects their inbox through Google OAuth or Microsoft OAuth. Rythm reads incoming mail through the provider API, builds a guest list once at setup from the user’s contacts, sent folder, starred messages, and inbox frequency, and keeps the list updating naturally as the user works. Senders on the list walk in. Senders not on the list see a one-time challenge: pay a small cover charge (typically a few cents) or wait in a clearly labeled folder the user can rescue from.
The architecture is non-custodial. Rythm never holds funds and never stores email content. When an unknown sender pays the cover charge, the payment is a Cashu bearer token attached to the email. Rythm validates the token in memory, melts it to the user’s own Lightning wallet, and discards the message body. The round trip takes milliseconds. The deeper protocol detail lives at /learn/cashu-protocol-basics and /learn/lightning-network-basics. You do not need to read either to deploy Rythm; both pages exist so your security team can.
The filter is structural, not probabilistic. There is no machine learning model deciding whether a message is spam. The check is binary: is the sender on the guest list, or did they put a tiny amount on the line. That property is what makes Rythm a bouncer rather than a lie detector. AI-generated phishing that looks indistinguishable from a real first email still has to pay or wait. The cover charge filters on intention, not authorship.
For the full security architecture (CSP, KMS, per-Lambda IAM, SSRF guard, PII redaction, fail-open behavior, incident response), see /security.
Questions IT teams ask.
The 16 questions that show up in every mid-market evaluation. If yours is missing, email the founder and we will add it.
What a pilot looks like.
Three steps, two weeks, ten inboxes. The founder runs the discovery call directly. There is no SDR layer.
01
Discovery call.
A 30-minute call with the founder. We walk through your current stack, the team you want to pilot on, and what success looks like. You leave with a written scope and a written set of pilot success criteria.
02
Pilot. 14 days, up to 10 inboxes.
Pick one team (often marketing, legal, or the executive office). Each inbox connects through OAuth in a tap. The auto-scan builds the guest list overnight. You measure against the success criteria from the discovery call.
03
Roll out.
Full rollout when the pilot meets criteria. Includes a 30-minute admin webinar and a one-page user note your IT team can paste into your onboarding portal. Most teams reach steady-state inside two weeks.
People you talk to.
One founder, one email address, one calendar. There is no SDR layer between you and the person who built this.
Sean Dudgeon
Founder, Rythm
I take every enterprise inquiry directly. Email sean@rythm.xyz with the team you are looking at, the existing email security stack, and the timing. I usually reply the same day, and I am happy to do a 30-minute scoping call for any team that wants to see whether Rythm makes sense before signing anything. For other contact routes (operational support, security incidents, general questions), see /contact.
Standing invitation
Rythm is small and recent. We do not yet have public enterprise reference customers. If you are evaluating Rythm for a 50 to 2,000 seat rollout and want to talk to a current team running it, ask. We will set up a call directly.
