Security
How Mailotte is secured
The detail version, written to be checked rather than believed. Most of what follows you can verify from outside with dig and curl, without taking our word for any of it.
What Mailotte protects you from — and what it doesn't
A security page that lists only strengths is a marketing page. So, plainly: Mailotte is not end-to-end encrypted. Our servers can process the content of your mail, and that is deliberate — it is what sorts your inbox, answers questions about it, and pulls receipts and bookings out of it. Encryption strong enough to prevent that also prevents those features; providers who choose it are making a different, equally valid trade: Proton Mail holds your mail with zero-access encryption, and Tuta encrypts further still. See the Proton comparison and the Tuta one, and pick them if that is your requirement.
What Mailotte does defend against: an advertising business model (there isn't one), your mail being used to train models (it never is), a network attacker between you and us, mail forged in your name, tracking pixels in the mail you open, and an attacker who has your password but not your second factor.
Encryption
- In transit: TLS everywhere. The marketing site and the app are HSTS-preloaded (
max-age=31536000; includeSubDomains; preload), and mail clients connect only over TLS — there is no plaintext IMAP or POP3 port to fall back to. The ports are listed here. - Between mail servers: MTA-STS in
enforcemode, so a sending server that respects the policy will not deliver to us over an unauthenticated connection, plus TLS reporting so we hear about failures. Check it yourself athttps://mta-sts.mailotte.com/.well-known/mta-sts.txt. - At rest: attachments and stored files are encrypted with AES-256 under a key we hold, not our hosting provider's. Message bodies are not separately encrypted at rest beyond the encryption of the underlying storage. We used to word this loosely; that was corrected, and a test now fails the build if an unscoped "encrypted at rest" claim reappears anywhere on this site.
- Secrets: passwords and recovery codes are stored as bcrypt hashes, never in the clear. A two-factor secret is encrypted at rest and decrypted only to verify a code.
Mail authentication, published
Anyone can verify these in a terminal — they are the records that stop someone forging mail from your address:
| Record | What we publish | What it means |
|---|---|---|
| SPF | ends in -all | A hard fail, not a soft one: mail from anywhere else is unauthorised. |
| DMARC | p=reject | The strictest policy. Forged mail is rejected, not quarantined. |
| DKIM | signed | Outbound mail is signed, including mail from your own custom domain. |
| MTA-STS | mode: enforce | Requires authenticated TLS between sending servers and ours. |
| TLS-RPT | published | Other providers report TLS failures to us, so we find out rather than guess. |
Account security
- Two-factor authentication with an authenticator app, and passkeys (WebAuthn) for passwordless sign-in.
- Recovery codes, stored hashed, so losing a phone does not lose the account.
- App passwords for mail clients: one per device, shown once, revocable individually without touching your main password.
- Rate limits on sign-in, registration, password reset and two-factor verification.
- Session invalidation: changing your password invalidates tokens issued before that moment.
- An audit log of security-relevant account events.
In the inbox
Tracking pixels are blocked before they load, spam and phishing are filtered on arrival, and PGP support is beta — keys are generated on our servers, so it is not end-to-end encryption and we do not market it as such.
Where your data lives
| Processor | Where | What for |
|---|---|---|
| Hetzner Online GmbH | Germany | Servers, mail storage and files. |
| Clever Cloud SAS | France | Managed PostgreSQL database. |
| Mistral AI SAS | Paris, France | AI fallback only, when our own model is unavailable. |
| Paddle | UK / US entities | Merchant of record for paid plans. Never receives mail content. |
| Cloudflare, Inc. | United States | Bot protection on the sign-up form only. Never receives mail content. |
Monitoring is first-party: traces and logs go to our own self-hosted stack on our German servers, not to a third-party provider. The privacy policy is the authoritative list and carries the transfer safeguards in full.
Reporting a vulnerability
Email security@mailotte.com. Our security.txt is published at the standard location for both the site and the app.
Please give us a reasonable window to fix an issue before publishing it, and don't run tests that degrade the service for other people or touch mailboxes that aren't yours. Use your own account: signing up is free. We will acknowledge your report, tell you what we find, and credit you if you'd like the credit.
What we do not claim
No SOC 2, no ISO 27001, no third-party penetration-test report, and no paid bug bounty. We are a small team and would rather list what is missing than imply a certification we do not hold. Everything asserted above is either checkable from outside or pinned by a test in our codebase.
Questions
Is Mailotte end-to-end encrypted?
No. Mailotte's servers process your mail, which is what makes triage, meaning-based search and receipt extraction possible. If your threat model requires a provider that cannot read your mail at all, use Proton Mail or Tuta — our comparison pages say so too.
Who can read my mail inside Mailotte?
Technically, the people who operate the servers can — that is the trade described above, and no policy changes it. Access to production is limited to them. Your own account's security events (sign-ins, two-factor changes, app passwords created or revoked, a PGP key released to a browser) are written to an audit log you can read in Settings; that log covers your account's activity, not ours. What we do not do is profile your mail, sell it, show ads against it, or use it to train any model.
Do you hold SOC 2 or ISO 27001?
No. Mailotte holds no third-party security certification today, and we would rather say that plainly than imply one. What we can show you is checkable from outside: the DNS records, the response headers, and the ports listed on this page.
Do you run a bug bounty?
Not a paid one. Reports are welcome at security@mailotte.com and we will credit you if you want the credit; we are not able to pay bounties at this stage.
Where is my mail physically stored?
On servers in the EU — Hetzner in Germany for mail and files, Clever Cloud in France for the database. The AI that reads your mail runs on our own servers in Germany, with an EU-resident fallback in Paris.
What happens if there is a breach?
Where a personal-data breach is likely to result in a risk to your rights and freedoms, GDPR requires notification to the supervisory authority within 72 hours, and to affected users without undue delay where the risk is high. That is the obligation we operate under; our privacy policy is the authoritative statement of it.
Looking for the shorter version, or the privacy side of this? Trust & Security covers what we store and what we never do; the privacy policy and GDPR page cover your rights and our legal basis.