Security and GDPR

Where your data lives and who can reach it matters as much as the encryption on top of it. This page covers how we store mail, how passwords and signing work, and what actually happens when you delete an account.

1. The mail host

Mail bodies, attachments and database records all live on the mail host, a dedicated server in Warsaw, Poland, behind the public edge. Mail, mailboxes and databases are stored only in Warsaw and never leave the EU, including as the platform scales, and no US cloud provider stores your mail.

• Encryption at rest. Customer PII and DKIM private keys are encrypted with AES-256-GCM through a KMS service. Master keys are held only in memory, never written to disk. Clients talk to the KMS over an X25519 + ML-KEM-1024 hybrid handshake.
• Tenant isolation. PostgreSQL row-level security isolates tenants, and email lookups use an HMAC blind index rather than the raw address.
• No public mail ports. The mail host answers nothing from the open internet. Mail arrives only through the edge over WireGuard; the control-plane API only through an outbound-only Cloudflare Tunnel.

2. Passwords and signing

No MD5, no SHA-1, no unsalted hashes anywhere in the system.

• Argon2id. Mailbox and account passwords are hashed with Argon2id, the Password Hashing Competition winner, which resists GPU and ASIC cracking far better than older algorithms.
• Account 2FA. Accounts can enable TOTP two-factor authentication.
• TLS 1.2 or newer. Mail connections require at least TLS 1.2; TLS 1.0 and 1.1 are disabled, with high cipher suites. Outbound TLS uses DANE with DNSSEC via Unbound.
• DKIM signing. Outbound mail is signed with 2048-bit RSA keys (selector mail), generated when a domain is verified. Rspamd also adds ARC sealing.

3. Deleting an account (GDPR)

Deletion is self-service. When you request it, here's what actually happens:

• 30-day grace period. The account and its mailboxes are suspended immediately and a purge is scheduled 30 days out. You can cancel the deletion until then.
• Lease-guarded purge. After the grace period, a worker runs a lease-guarded, multi-step job that removes the database records and the Maildir on disk.
• Audit record. Audit rows are kept for legal defence with the IP address removed, so there is a record that the deletion happened without keeping the mail itself.