Security
Here is what we do to keep your mail safe, in plain words. We only write what is true today. No system is perfectly safe, so we also tell you what we do not do.
Your connection is private
You reach uMail over an encrypted connection (HTTPS). When we send mail to other servers, we use an encrypted connection when the other server supports it.
Passwords and sign-in
- We never store your password in readable form. We store a protected form of it.
- We slow down and block repeated wrong password tries.
- Your sign-in cookie cannot be read by scripts on the page. It is sent only to uMail, and only over an encrypted connection.
- Company owners can reset passwords, suspend users and remove mailboxes.
Secrets are locked
Keys and tokens that you or we save in uMail, for example for a connected service, are stored encrypted. They are never sent back to your browser.
Mail that proves where it came from
When you add your domain, we help you set it up so that we sign your mail. This lets other mail systems check that a message really came from you and was not changed on the way. It makes it much harder for someone to pretend to be you.
Spam and viruses
Software checks incoming mail for spam and harmful content. Spam goes to the Junk folder. This is done by software to protect you. It is not used to profile you.
Safe reading
- Pictures in emails are hidden until you choose to show them.
- Tracking pixels are always blocked.
- When you show pictures, they load through uMail, so the sender does not see your address.
- Scripts in email never run.
- Attachments are downloaded. They are never opened inside the page.
Who can see your data
Access to our systems is limited to staff who need it to do their work. We do not read your mail, and we do not use it for advertising. Read the Privacy policy and the Data processing agreement for the full rules. The companies that help us run uMail are on the Sub-processors page.
Abuse
We set limits on how much mail can be sent, and we look into abuse reports. See the Acceptable use policy.
Report a security problem
If you think you found a weakness in uMail, please write to security@umail.et. Tell us what you found and how to repeat it. Please give us a reasonable time to fix it before you tell others, and do not look at other people’s data. We will answer, and we will not take action against people who report in good faith.