Security Overview & Responsible Disclosure

How we protect your account

• Encryption in transit: connections to the web app use TLS (HTTPS), with HTTP Strict Transport Security in production. Mail exchanged with other providers uses TLS where the other server supports it.
• Passwords: stored only as one-way hashes by our mail server. New passwords are checked against known data breaches using Have I Been Pwned's k-anonymity method. The Vault's breach check works the same way: your browser sends only the first 5 characters of each password's hash and compares the rest itself.
• Sessions: while you are signed in, your mailbox password is held in a server-side session encrypted with AES-GCM. The session cookie is HttpOnly and Secure.
• Two-step verification: authenticator app codes (the secret is stored encrypted) and single-use backup codes (stored as one-way hashes).
• Passkeys: phishing-resistant sign-in using WebAuthn. We store only your passkey's public key.
• Sign-in history: you can review recent sign-ins and active sessions, and sign out other devices, in Settings.
• Automated protection: sign-up and password reset include bot protection, and incoming mail is scanned for spam and malware.
• Tracking protection: external images in emails are blocked by default.
• Optional end-to-end encryption with OpenPGP. See End-to-End Encryption.

What we do not claim

Unless you use end-to-end encryption, your messages are stored on our servers in a form our systems can read, so they can be searched, filtered and delivered. We do not currently claim any independent security certification. Drive files and attachments are encrypted at rest, each with its own key. Messages you send end to end encrypted stay encrypted on our servers.

No online service can be perfectly secure. You can help by using a unique password, turning on two-step verification or passkeys, and keeping your devices up to date.

Reporting a vulnerability

If you believe you have found a security vulnerability in Viremail, please tell us at [email protected]. Our security.txt file lists our current security contact.

Please include:

• a description of the issue and its potential impact;
• step-by-step instructions to reproduce it;
• any proof-of-concept code, screenshots or request logs;
• how you would like to be credited, if at all.

We aim to acknowledge reports within 5 working days and to keep you updated as we investigate and fix the issue.

Rules for testing

• Only test against accounts you own or have explicit permission to use.
• Do not access, change or delete other people's data. If you encounter it, stop and tell us.
• Do not carry out denial-of-service attacks, spam, social engineering or physical attacks.
• Do not use automated scanners that generate large volumes of traffic.
• Give us reasonable time to fix the issue before sharing details publicly.

Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not take legal action against you, and we will not ask law enforcement to investigate you, in relation to that research. If a third party takes legal action against you for activity that followed this policy, we will make it known that your actions were authorised.

This safe harbour does not cover activity that breaks the law or goes beyond what is needed to demonstrate the issue.

Rewards

We do not currently run a paid bug bounty programme and cannot promise payment for reports. With your permission, we are happy to thank you publicly for valid reports.

Business accounts

Draft for legal review. This part describes Business Viremail and does not apply until it has been approved and published.

• Each business is kept apart: every business request is checked against that business first, and outsiders get a not-found answer.
• Before any change to a mailbox, we check its address is on a verified domain of the same business.
• New passwords are shared with one-time links, kept only as a hash, and valid once for 72 hours at most.
• Business admin actions are written to an audit log where each entry is chained to the one before with a keyed hash.
• Coming soon: two-step sign-in required for business admins, and session limits.