How Your Data Is Protected
We use layered safeguards to reduce exposure of account and message data. This page describes the protections used by the service; it is not a guarantee that any online service is risk-free.
Encryption for stored data
Selected sensitive account records and message copies are encrypted by the service before they are stored. Account-context encryption uses AES-GCM, an authenticated encryption method that detects unauthorized changes to encrypted content.
Encryption keys are derived using secret server-side key material and account-specific context. The secret values are not published here and should not be stored alongside the encrypted database records.
This is encryption at rest, not end-to-end encryption: the service must process message content to route or deliver it. Recipients' mail providers and systems may handle messages after delivery.
Passwords and lookup values
Passwords are not stored as reversible encrypted text. The service stores salted, computationally expensive PBKDF2-HMAC-SHA-512 password verifiers and checks a submitted password against that verifier during sign-in.
Some values used for matching or integrity checks are represented by derived hashes rather than by the original value. Depending on their purpose, these use keyed HMAC-SHA-256 or a 4096-bit output derived from SHA-512; not every lookup hash is keyed. A hash is not encryption and cannot be decrypted to recover its input.
A 4096-bit output describes its stored length, not 4096 bits of guessing or collision resistance. Its security depends on the underlying construction, secret key material where used, and the entropy of the input; longer output alone does not make a guessable value secret.
Integrity, access, and retention
Authenticated encryption and keyed integrity checks help the service detect alteration of protected values. Account-specific context is used in applicable encryption and lookup operations to reduce unintended cross-account matching or access.
Not every operational field is encrypted: the service retains limited metadata needed for routing, account ownership, search, and lifecycle operations. Access controls and data minimization complement encryption.
Stored copies and security records are subject to the retention and deletion rules described in our Privacy Policy and How to Delete My Data page.
Separate service roles
Providing email forwarding requires separate application, database, and mail-delivery functions, and may involve service providers described in the Privacy Policy. This separation supports operating the service, but should not be understood as a promise that every system or provider is physically isolated or located in a particular region.
Transport and storage protections do not control what happens in a recipient's mailbox. For additional message confidentiality, users can configure OpenPGP or S/MIME for supported identities and correspondents.