Security

How we keep your accounts and messages safe.

Security isn't a feature bolted on later — it's how WeMails is built. Below is exactly what we do.

Encryption

  • In transit: the app is served over TLS, and every connection to your mailboxes uses IMAPS/POP3S (SSL/TLS) or STARTTLS.
  • Login passwords: stored as a one-way hash (bcrypt/Argon2). We can never recover them.
  • Mailbox passwords: encrypted at rest with AES-256-GCM. The master key lives outside the web root and the password is discarded the moment a job finishes.
  • Backups: each email is encrypted individually with a key derived from your passphrase via PBKDF2-SHA256. Without your passphrase, a backup archive is unreadable — even to us.

Isolation & access control

  • Chain scoping: every read and write is scoped to your account. A tampered request can never reach another user's data.
  • Per-job stores: each migration and backup runs in its own isolated database file.
  • Public identifiers only: we never expose sequential/internal IDs — every reference is a random public ID, so nothing can be guessed or enumerated.
  • Minimal responses: our API returns only what a screen needs — never internal fields, hashes or other users' data.

Account protection

  • Two-factor authentication (Google Authenticator / TOTP).
  • Session binding to IP range and device, with server-side revocation.
  • CSRF protection on every state-changing request.
  • Login lockout after repeated failures.
  • Security headers (CSP with per-request nonce, HSTS, X-Frame-Options, nosniff).

Anti-abuse

  • Anti-SSRF: the hosts you enter are resolved and validated — private, reserved, loopback and cloud-metadata addresses are blocked, so our workers can't be tricked into reaching internal systems.
  • Audit logging: logins, session events, credential access, admin actions and denied access are recorded with IP, device and session, so abuse can be detected and proven.
  • Move safety: in "migrate & delete", a message is only removed from the source after it is confirmed at the destination.

Responsible disclosure

Found a vulnerability? Email security@wemails.com. We appreciate coordinated disclosure and will work with you to fix issues quickly.