Security FAQ

1. Is my mail encrypted?

Yes. Every connection to indoemail.in uses HTTPS (TLS 1.2 or 1.3). Mail between Indo Mail and other providers uses TLS whenever the other server supports it. Stored files are encrypted at rest on Amazon Web Services in Mumbai.

Mail between two Indo Mail accounts is also end-to-end encrypted by default: the text is locked on the sender's device for the recipient's devices, and Indo Mail stores only the locked copy. The subject line, the addresses, the time and attachments are not end-to-end encrypted in the current version. Mail to Gmail, Outlook and other providers cannot be end-to-end encrypted; it is protected by TLS in transit.

2. Can Indo Mail staff read my mail?

End-to-end encrypted mail and chats cannot be read by anyone at Indo Mail. Other mail is processed automatically by our systems to deliver it, filter spam and viruses and show it to you. Staff do not read mail content. Access to production systems is limited to a small number of engineers, logged, and used only to keep the service running or when the law requires it, as described in our Law Enforcement Guidelines.

3. Does Indo Mail scan my mail for advertising?

No. Ads are never chosen by reading mail, attachments, contacts or files. Mail is scanned only for spam, phishing and viruses (Indo Shield), and by Indo Mail AI only when you ask it to do something.

4. How do I protect my account?

• Use a long, unique password, and keep a different one for every service. Indo Passwords can generate and store them.
• Turn on 2-Step Verification in Settings → Accounts and Import.
• Add a recovery email and mobile number.
• Check Settings → Accounts and Import → Sign-in history now and then.
• Never share an OTP, UPI PIN or password with anyone, including people who say they work for Indo Mail. We never ask for them.

5. What does Indo Mail do when something looks wrong?

An activity monitor checks sign-ins, sending volume, bounces, spam reports and chat volume every five minutes. It uses activity records only, never message content. If you sign in from a new country we email you. If an account sends mail that bounces a lot or is reported as spam, sending to other providers is paused for up to 24 hours while our team reviews it.

6. Are my saved passwords safe?

Indo Passwords encrypts every entry in your browser with a key made from your master password (PBKDF2-SHA256 with 600,000 rounds, then AES-256-GCM). Indo Mail stores only the encrypted entries and never sees the master password. This also means we cannot recover your saved passwords if you forget it.

7. What about AI agents and apps that use my mailbox?

Agent Inbox keys let an AI agent or script you choose read or send mail from your mailbox, with only the permissions you tick. Each key is shown once, can be revoked at any time, is limited to 60 requests a minute, and shows when it was last used. End-to-end encrypted messages stay locked to your devices.

8. Do you hold security certifications?

No. Indo Mail does not hold ISO 27001, ISO 27701, SOC 2 or any other external certification today, and we do not claim them. Amazon Web Services holds certifications for its data centres; those cover Amazon's infrastructure, not Indo Mail's own software.

9. How do I report a security problem?

Write to security@indoemail.in. For a vulnerability, include the steps to reproduce it and do not access other people's data. We acknowledge reports within 24 hours. If your account was hacked, change your password, turn on 2-Step Verification and open a Security case in the Support Center (indoemail.in/support); it is handled first.