CodaMail’s privacy preserving CalDAV/CardDAV platform represents a complete rethinking of secure, standards-compliant calendar and contact synchronization. Built entirely around WebDAV/CalDAV/CardDAV RFC standards, it introduces a modern, database-driven architecture with dynamic permissions, tokenless access control, zero-knowledge resource access, and full compatibility with all major DAV clients.
The CodaMail DAV system is a fully RFC-compliant CalDAV/CardDAV/WebDAV server that integrates directly with webmail’s calendar and contact management. It offers seamless interoperability while replacing traditional static authentication and ACL models with a dynamic, database-backed permission framework.
At the heart of this system is Dual Auth, a mechanism that uses an auth pair to uniquely and securely identify access sessions without relying on static usernames, passwords, or tokens.
The Dual Auth system introduces a combined authentication pair: a randomly generated login and password, hashed together and stored only as a single hash entry in the database. The actual login and password values are never stored or recoverable, even by the system itself.
Unlike traditional ACL models that apply static permissions at the resource or collection level, the CodaMail DAV system enforces CRUD-level (Create, Read, Update, Delete) permissions at the HTTP method level. This allows dynamic changes in access rights to take effect immediately without requiring reauthentication, token invalidation, or re-issue.
Each auth pair defines specific allowed operations. These permissions can be changed in real time, offering precise control over what each client or integration can do.
Auth pairs are issued with optional expiration policies. They can be automatically or manually revoked, immediately preventing any further access. Because all permission checks occur per-request, revocation takes effect instantly, ensuring robust control in sensitive environments.
Despite its advanced security model, the system maintains compliance with all relevant standards, including, but not limited to:
The above properties which would normally contain identifying information are returned with privatized data. Randomized principals properly map. ACLs also properly map to our own unique method level dynamic permissions.
This ensures out-of-the-box compatibility with clients such as Apple Calendar, iOS, macOS Contacts, Thunderbird, DAVx5 with Android, Outlook with DAV plugins, and others — all without requiring protocol extensions or proprietary modifications.
The CodaMail DAV server integrates tightly with the webmail’s calendar and contacts, providing a unified interface for web and native client synchronization. Users can create, manage, and revoke auth pairs directly from their webmail environment, streamlining security management.
The CodaMail CalDAV/CardDAV server represents a major evolution in privacy-first, RFC-compliant groupware. Its Dual Auth architecture combines the security of zero-trust design with the usability of standard DAV protocols, enabling a modern, scalable, and resilient approach to personal and organizational data synchronization.
This privacy-preserving WebDAV system is protected by:
U.S. Provisional Patent Application No. 63/838,770 filed July 4, 2025, titled "System and Method for Dual-Random Component Authentication"
U.S. Provisional Patent Application No. 63/838,831 filed July 4, 2025, titled "System and Method for Privacy-Preserving Resource Access Through Dynamic URL Routing"