Security Whitepaper

1. Purpose and scope

This whitepaper explains how Indo Mail protects the mail, files and account details that people trust it with. Indo Mail is the email service of INDO CHATS PRIVATE LIMITED, run on indoemail.in and hosted by Amazon Web Services in the Mumbai region (ap-south-1).

It covers the live service at release 1.3 and the controls added in release 1.4. Where a control is not yet live, we say so plainly and list it under the roadmap. We do not claim any certification. ISO 27001, ISO 27701 and SOC 2 are planned, not held.

2. Our approach: defence in depth

No single control is enough on its own. We stack independent layers so that a failure in one layer is caught by the next. An attacker who gets past the network edge still meets strict browser rules, short-lived tokens, hashed passwords, private storage and logged access.

We also keep the attack surface small. The web app loads no third-party scripts, fonts, analytics or trackers. Every byte the browser runs comes from indoemail.in.

3. Transport security

All web traffic uses HTTPS. The server accepts TLS 1.2 and TLS 1.3 only, with modern forward-secret cipher suites (ECDHE with AES-GCM or ChaCha20-Poly1305). Older protocols such as TLS 1.0 and 1.1 are switched off. Session tickets are disabled so that a stolen ticket key cannot unlock past sessions.

Plain HTTP requests are redirected to https://indoemail.in. Every response carries a Strict-Transport-Security header with a two-year lifetime, includeSubDomains and preload, so browsers refuse to talk to indoemail.in over plain HTTP at all.

The mail server on port 25 offers STARTTLS using the same Let's Encrypt certificate that covers indoemail.in, www.indoemail.in and mail.indoemail.in. Certificates renew automatically. A renewal hook reloads the web server and the mail service so the new certificate is used straight away.

4. Mail authentication, inbound and outbound

Incoming mail. Every message that arrives from another provider is checked against SPF, DKIM and DMARC. The verdicts are stored with the message so the recipient can see them. A message goes to Spam when it fails DMARC and the sending domain asks for quarantine or reject, or when it fails SPF and has no passing DKIM signature.

Outgoing mail. Every message leaving Indo Mail is signed with DKIM. Personal addresses use the indoemail.in key. Each business customer gets its own DKIM key for its own domain, generated when the domain is added, so one customer's reputation never depends on another's. Mail to outside providers is relayed through Amazon Simple Email Service (SES) in Mumbai. SES production access is pending.

Each account may send up to 500 messages a day. This limit protects the shared sending reputation and slows down any compromised account. Failed deliveries are retried for about three days and then returned to the sender as a bounce message.

5. Application security

The web app is built so that hostile content in an email cannot run code or leak data.

End-to-end encryption: Chat and, from release 2.0.0, email between Indo Mail accounts are encrypted on the device. Each device creates an ECDH P-256 key pair in the browser or app; the private key is non-extractable and stays in the device's storage. Every message gets a fresh AES-256-GCM key, which is wrapped for each recipient device with a key derived by ECDH and HKDF-SHA256. The server stores only ciphertext and the wrapped keys. Limits: the subject line, addresses, time and attachments of email are not end-to-end encrypted in this version; the scheme has no per-message forward secrecy (it is not the Signal Double Ratchet); a newly added device cannot read messages sent before it was set up; external mail uses TLS only.

• Content Security Policy. Scripts load only from indoemail.in. Plugins and objects are blocked. Forms may post only to indoemail.in. The app cannot be framed by other sites. Network calls are limited to indoemail.in and the named Amazon endpoints for Drive and Maps.
• Sanitised HTML. HTML email is cleaned before display. Scripts, event handlers and dangerous elements are removed.
• Isolated frames. Each message body is shown inside a sandboxed frame with scripts disabled and no referrer, so it cannot reach the rest of the app.
• Remote images blocked. Images hosted elsewhere are not loaded until the user chooses to show them. This stops tracking pixels from reporting when and where a message was opened.
• Rate limits. Sign-in, sign-up and change-password routes allow 20 attempts per 15 minutes from each IP address. Further attempts are refused with a clear message.
• Password hashing. Passwords are stored only as bcrypt hashes with a cost factor of 12. We never store or log the plain password.
• Other headers. A strict Referrer-Policy, a Permissions-Policy that turns off camera, microphone, payment, USB, serial, Bluetooth and interest tracking, and no server version banners.

6. Tokens and sessions

We use several narrow tokens instead of one powerful one. Each token can do one job and expires quickly.

Web Push uses VAPID (RFC 8292) to prove that notifications come from Indo Mail, and RFC 8291 (aes128gcm) to encrypt every payload. The browser push services operated by Google, Mozilla, Apple and Microsoft relay only encrypted data they cannot read. A user can see and remove each device that receives notifications.

7. Storage security

Mail and the account database live on the application server's encrypted block storage in Mumbai. Drive and Photos files are stored in Amazon S3 in Mumbai with server-side AES-256 encryption.

S3 buckets are private. Public access is blocked at bucket level. Browsers and apps never receive storage credentials. Instead, the server issues presigned links that name one object, one action and a short expiry. Large files are uploaded straight to S3 in 64 MB parts, each with its own signed link. Unfinished uploads are cleaned up by a lifecycle rule.

Storage use is counted per account across Mail, Drive and Photos. Uploads that would exceed the plan quota are refused before any data is written.

8. Infrastructure security

• Region. Production runs in AWS Mumbai (ap-south-1). Data of Indian accounts is stored in India.
• Least privilege. The application runs as its own unprivileged system user. It is allowed to bind port 25 and nothing more. The service unit protects system folders from writes and blocks privilege escalation. Each AWS role can reach only the resources it needs.
• Firewall. Only SSH, SMTP (25), HTTP (80, for redirects and certificate checks) and HTTPS (443) are open. The Node.js application listens only on 127.0.0.1:3000 behind nginx.
• Keyless deployments. GitHub Actions signs in to AWS with OpenID Connect. No long-lived AWS access keys are stored in the repository or in GitHub.
• Secrets outside code. Passwords, signing keys and API credentials live in a protected settings file on the server, outside the application folder, readable only by the service. Nothing secret is committed to source control.
• DNS. Route 53 hosts the indoemail.in zone, including MX, SPF, DKIM and DMARC records.

9. Mobile apps

The Android app (1.3.0, Android 7.0 and later) and the iPhone app load only https://indoemail.in. On Android, a network security configuration blocks all cleartext traffic and the in-app browser has Google Safe Browsing switched on, so known phishing and malware links are flagged before they open. The Android package is signed with Indo Mail's release key, and indoemail.in publishes the matching fingerprint so the operating system can confirm the app belongs to the site.

10. Operations

Security monitoring: a monitor runs every 5 minutes over activity records (sign-ins, sending volume, bounces, spam reports, chat volume) and raises internal alerts, with email to the security mailbox for high-severity alerts and an Admin console view to resolve them or to pause or resume an account's sending.

• Automatic updates. Every tested change is packaged by GitHub Actions. The server checks for a new release every two minutes, installs it, runs a health check and rolls back automatically if the check fails.
• Backups. The database is copied every night with a consistent online backup. The Lightsail server is also protected by automatic daily snapshots. Drive files rely on the durability of Amazon S3.
• Logs. Security and access logs are kept for one year in India (at least 180 days are required by the CERT-In Directions of 28 April 2022). From release 1.4 every sign-in is recorded with time, IP address and device.
• Status page. https://indoemail.in/api/ops/status shows certificate, HTTPS, sending and receiving health. It reports counts and settings only, and masks email addresses and keys.

11. Security roadmap

The following controls are planned. They are not live today.

12. Reporting a vulnerability

If you find a security weakness in Indo Mail, please email security@indoemail.in. Include the affected address or feature, the steps to reproduce it and the impact you expect. We acknowledge reports within two working days and keep you informed until the issue is fixed.

Safe harbour. We will not take legal action against, or ask law enforcement to act against, anyone who researches in good faith under these rules:

• Test only against your own accounts or accounts you have permission to use.
• Do not read, change or delete other people's data. Stop and tell us if you reach it by accident.
• Do not degrade the service, send spam or run denial-of-service tests.
• Give us reasonable time to fix the issue before you disclose it publicly.
• Do not demand payment as a condition of disclosure.

13. Contact

Security reports: security@indoemail.in. Privacy questions: privacy@indoemail.in. General help: support@indoemail.in.

INDO CHATS PRIVATE LIMITED, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India.