Security
How we keep your accounts and messages safe.
Security isn't a feature bolted on later — it's how WeMails is built. Below is exactly what we do.
Encryption
- In transit: the app is served over TLS, and every connection to your mailboxes uses IMAPS/POP3S (SSL/TLS) or STARTTLS.
- Login passwords: stored as a one-way hash (bcrypt/Argon2). We can never recover them.
- Mailbox passwords: encrypted at rest with AES-256-GCM. The master key lives outside the web root and the password is discarded the moment a job finishes.
- Backups: each email is encrypted individually with a key derived from your passphrase via PBKDF2-SHA256. Without your passphrase, a backup archive is unreadable — even to us.
Isolation & access control
- Chain scoping: every read and write is scoped to your account. A tampered request can never reach another user's data.
- Per-job stores: each migration and backup runs in its own isolated database file.
- Public identifiers only: we never expose sequential/internal IDs — every reference is a random public ID, so nothing can be guessed or enumerated.
- Minimal responses: our API returns only what a screen needs — never internal fields, hashes or other users' data.
Account protection
- Two-factor authentication (Google Authenticator / TOTP).
- Session binding to IP range and device, with server-side revocation.
- CSRF protection on every state-changing request.
- Login lockout after repeated failures.
- Security headers (CSP with per-request nonce, HSTS, X-Frame-Options, nosniff).
Anti-abuse
- Anti-SSRF: the hosts you enter are resolved and validated — private, reserved, loopback and cloud-metadata addresses are blocked, so our workers can't be tricked into reaching internal systems.
- Audit logging: logins, session events, credential access, admin actions and denied access are recorded with IP, device and session, so abuse can be detected and proven.
- Move safety: in "migrate & delete", a message is only removed from the source after it is confirmed at the destination.
Responsible disclosure
Found a vulnerability? Email security@wemails.com. We appreciate coordinated disclosure and will work with you to fix issues quickly.