Security

Last updated: 5 October 2026

PlainMailOS reads your mail to work, so protecting it is the core of the product. This page describes what we do today. We don't yet hold third-party certifications such as SOC 2 or ISO 27001.

Your data

• All traffic to PlainMailOS uses TLS, and browsers are told to use HTTPS only (HSTS).
• Mailbox credentials (Google and Microsoft tokens, IMAP passwords) and two-step verification secrets are encrypted at rest with AES-256-GCM.
• IMAP connections always use TLS (port 993) or STARTTLS (port 143), and only to public mail servers.
• Passwords are stored only as Argon2id hashes.
• The database is backed up daily; backups are kept for 14 days.

Who can see what

• A mailbox you connect yourself is private to you: organization administrators can't open it unless you share it.
• Every request is checked on our servers against your organization role and your access to each mailbox. Automated tests run on every change and try each route as a signed-out visitor, as a member of another organization and as an ordinary member, and fail the release if anything leaks.
• PlainMailOS staff do not read your mail. Our internal tools show account, billing and error information, not message content.
• Significant changes in your organization (roles, settings, sign-in policy) are recorded in an audit log.

Your account

• Two-step verification with an authenticator app, which organizations can require for every member.
• Repeated failed sign-ins lock the account temporarily; you can see and end your other sessions.
• Single sign-on (SAML / OIDC) and SCIM provisioning on the Enterprise plan.
• Email verification before an address is trusted, and sign-in with Google only for verified Google addresses.

The service

• Strict security headers, including a Content Security Policy that blocks framing and third-party scripts other than our payment processor.
• Rate limits on sign-in, sign-up and other sensitive actions.
• Dependencies are scanned on every release; releases with known high or critical vulnerabilities are blocked.
• Errors and service health are monitored around the clock, with alerts to our team. Live status is at plainmailos.com/status.

AI

AI assistance is off unless your organization turns it on. What it sends, and to whom, is described in the privacy policy (§4).

Reporting a vulnerability

If you believe you've found a security problem, email grievance@plainmailos.com with the details. Please give us a chance to fix it before telling others, and don't access other people's data while testing. We will reply within 2 business days.