How imado protects your mail

• Every connection to imado is encrypted (TLS). Mail between imado and other mail systems is sent and received over TLS where the other side supports it, which is nearly everywhere.
• Stored mail, meaning the parsed messages, the attachments, and the original raw message, is encrypted at rest by the providers that hold it: Amazon S3 for the raw messages, PlanetScale for the database.
• Passwords are stored hashed, never in a form anyone can read. We cannot tell you yours.

Nobody at Zivaro Software Inc. can sign in as you. The tooling has no impersonation capability, and there is no support screen that opens a mailbox. The operator's view of the product shows counts, what is in flight, and domain names — never a message, never an address.

The people who operate the service can reach the underlying storage, because somebody has to be able to repair it. The privacy page says when they do.

• Every notification our mail provider sends about a message (arrival, delivery, bounce, complaint) has its signature verified before anything is recorded from it.
• A message's HTML is shown inside a sandboxed frame on its own origin. Scripts, forms, embedded frames and every event handler are removed before it is rendered, and the frame is allowed to fetch images and nothing else.
• An attachment is served as a download and only a download, and the file you get is checked against a fingerprint (a SHA-256 digest) recorded when the message arrived.
• Addresses you type are parsed under a strict grammar before any message is sent, and mail to an address that nobody created is refused rather than accepted and lost.

• An account needs a verified email address before it can do anything.
• Sign-in attempts are limited to 10 a minute per network address, sign-ups to 10 an hour, and password-reset mail to 3 in 10 minutes. The limits are shared across every server, so they cannot be dodged by hitting a different one.
• One cookie keeps you signed in. Your theme preference stays in your browser.
• A suspended account is refused at sign-in, with a sentence saying how to reply.

• Two-factor sign-in. Today a verified address, a hashed password and rate-limited sign-in protect the account.
• Malware scanning of attachments. Today a file is served exactly as it arrived and only as a download, so nothing runs in your browser, and opening it is your decision.
• Loading images through our own servers, so a sender sees us rather than you. Today they load from the sender, as in most mail apps — the privacy page says what that means.
• An external audit and a disclosure programme. Until then, this page names what is built, and the address below is read by the people who built it.
• Deleting your account from inside the product. Today a written request is completed within 30 days.

When one of these lands, this page changes with it.

Write to ashish.so@zivaro.ai with “security” in the subject. The same address is published at /.well-known/security.txt. You will hear back within two working days, with what we found and when it was fixed.

Please do not read, change or delete mail that is not yours while demonstrating a problem, and do not run anything that degrades the service for other people. A report made in that spirit is welcome, and we will not pursue anyone for one.