Security, privacy and GDPR
What protects your email, from whom, and what is left out.
Encryption in transit
Every port that mail apps connect to requires encryption. An app configured without encryption cannot log in: the server refuses the password before receiving it.
- Accepted versions: TLS 1.2 and TLS 1.3. Earlier versions are refused.
- IMAP: port 993 with TLS, or 143 with STARTTLS. POP3: port 995 with TLS, or 110 with STARTTLS.
- Sending (SMTP): port 465 with TLS, or 587 with mandatory STARTTLS. Authentication is offered only once the channel is encrypted.
- Between mail servers (port 25): STARTTLS whenever the other server offers it, with the same TLS versions.
Encryption at rest, one key per mailbox
Every mailbox has its own key pair, stored encrypted and independent of the person's password: changing or resetting a password does not make the email unreadable.
A database dump, a disk or a backup archive, on their own, do not open any mailbox.
| Someone holding… | Can they read the email? |
|---|---|
| a database dump, only | No |
| the disks or the backup archives, only | No |
| one person's credentials | Yes, that mailbox |
What the provider sees
What we see
- The state of the system and the system logs.
- The same administration data you see: people, mailboxes, quotas, delivery outcomes.
What we do not do
- Use the content of your email for advertising or for our own purposes.
- Train systems on your email, apart from your domain's spam filter.
- Keep message subjects and bodies in the delivery log.
- Put third-party cookies, pixels or scripts on this site.
Separation between customers
The boundary between one organisation and another is enforced by the database, with row-level security policies, and watched by automated tests.
- Whoever administers your domain sees people, mailboxes and quotas, not the content of the mailboxes.
- Reading someone else's mailbox requires a delegation, which stays on record.
Access
- Second factor available on webmail and panel, with a time-based code.
- Passwords of at least 12 characters, different from the last three.
- Web sessions that expire after 30 minutes of inactivity, and after 10 hours in any case.
- One app password per device, revocable one by one: if you lose your phone, the others keep working.
- The sender must match the authenticated mailbox, unless there is a send-as delegation.
Anti-spam and anti-virus
Every message goes through the rspamd anti-spam filter and the ClamAV anti-virus, in two instances: if one does not answer, the other takes over. A message carrying a virus is refused. If the filter does not answer, mail does not pass unchecked: it is deferred and the sending server tries again.
Sending limits stop a compromised mailbox from sending spam in your name for hours.
Backups
One backup a day per customer, encrypted and signed, kept off site for seven days. The key that decrypts the backups is not on the system.
When a mailbox is removed
The key is deleted together with the mailbox: the messages become unreadable for ever, in backups too. The panel asks for explicit consent before going ahead. To keep the email of someone leaving the organisation, suspend the mailbox: suspension deletes nothing.
Where the data is
Mailboxes and backups are on servers in Germany and Finland, in the European Union.
GDPR: roles and data processing agreement
For the paid service your organisation is the controller of the data in its mailboxes; we are the processor, and we process that data on its behalf and according to its instructions (Art. 28 GDPR).
The data processing agreement (DPA) is available on request from privacy@mailpod.app, before you subscribe.
- Sub-processor for mailbox data: Hetzner Online GmbH, Germany, which hosts the infrastructure. It is the same list as on the privacy page.