Your keys, your server
bot-gateway runs the Mailbees core next to your code. Messages are decrypted only inside your container; the relay sees the bot as any other account.
A bot is a regular Mailbees account running in your own container. You talk to it over plain HTTP and JSON; the keys never leave your volume.