Skip to main content
mailservr

How mailservr keeps your email private and secure

Security is part of how the product is built. Mail stays in a dedicated alias inbox, while the private contact address remains separate from delivery and sending.

Infrastructure and storage

  • •Email content stored in PostgreSQL
  • •Attachments stored in S3-compatible (R2) object storage
  • •Attachment access controlled via time-limited presigned URLs
  • •No forwarding into a separate personal inbox or exposure of your contact address

Authentication

  • •Passwords hashed with bcrypt (industry-standard key derivation)
  • •Session-based authentication with 7-day automatic expiry
  • •First-party password and session authentication
  • •Admin-level access controls for domain management

API security

  • •Per-user bearer tokens for API-key requests and signed sessions for browser requests
  • •API keys scoped to individual user accounts
  • •Webhook payloads signed with HMAC-SHA256 for integrity verification
  • •Webhook delivery logs for auditing and debugging

Data handling

  • •Account, mailbox, billing-reference, and operational data limited to running the service
  • •Credit card data handled entirely by Stripe (never touches our servers)
  • •No advertising or behavioral profiling of mailbox content
  • •Outbound attachment validation (30 MiB raw per file; 40 MiB Base64 aggregate)

Operational security

  • •Inbound alias mail is not forwarded to your private contact address
  • •Sender blocking at the per-alias level
  • •Protected routes enforce session, entitlement, ownership, and admin checks
  • •Dashboard and API endpoints excluded from public sitemap and robots

Privacy by design

  • •Annual billing data is handled by Stripe; Free does not need a card
  • •Free is not ad-supported (your email is not the product)
  • •Minimal data collection: we store what is needed to deliver email, nothing else
  • •Mailbox, security, billing, and integration controls available through the dashboard

Security FAQ

Can mailservr read my emails?

Email content is stored to provide inbox functionality. We do not monetize mailbox content or use it for advertising. Infrastructure and billing processors handle only the data needed to operate the service.

Where is my data stored?

Email data is stored in PostgreSQL and attachments are stored in Cloudflare R2. Attachment downloads use time-limited HTTPS URLs; database transport is controlled by the deployment's PostgreSQL connection settings.

Can I permanently delete email?

Yes. Move conversations to Trash and empty Trash when you want to permanently delete them. The scheduled purge also removes trashed conversations after the retention window.

Do you comply with GDPR?

We follow data minimization principles and only collect what is necessary to provide the service. You can delete your own mailbox content and contact us for privacy or data-subject requests.

Next steps

Create accountPrivacy policyPrivacy guideView pricing