#Security
Last updated: November 9, 2026
How we keep mail and accounts safe. Short version for customers, not an audit report.
We run our own sign-in and mail stack. No ads in the inbox. Third parties that help with hosting, storage, edge, analytics, and payments are on Vendors.
#Sign-in
Passwords live in our identity service. You can also use Google, Apple, or GitHub. Every API request checks your session. On an organization domain, admins can require SSO for that domain’s mailboxes.
#Opening mail
Untrusted HTML is cleaned before you see it. The message body runs in a sandboxed iframe. Remote images load through our proxy so the sender does not get your IP, and the proxy only fetches public http(s) URLs. Attachments download as files; risky inline types stay blocked.
#Encryption
Apps talk over HTTPS. SMTP uses STARTTLS where the path needs it. Disks and object stores that hold mail sit on encrypted volumes.
We do not encrypt each message with OpenPGP inside the mail server. Search and the web client need the mail readable there. Volume encryption still covers those stores. Same note is in the Privacy Policy and DPA Schedule 2 for organization customers.
#Privacy switches
Product analytics (PostHog) stays off until you turn it on, and never loads on the marketing site. Details: Cookies. Organization admins can export and purge mailboxes they control. Closing an account follows the clock in the Privacy Policy.
#Status and reports
Uptime is on the status link in the site footer (status.postra.so).
Found a security issue? Email security@postra.so with enough detail to reproduce it. Skip other people’s mail unless they asked you to include it. Privacy requests go to privacy@postra.so.