Indo MailPolicies & help › Technology
Shared Responsibility
Who is responsible for what: the security work Indo Mail does, the work our cloud provider does, and the steps that stay with you or your company's administrator.
1. Why this page exists
Keeping mail safe is shared work. Some parts can only be done by Indo Mail, some by our hosting provider, Amazon Web Services, and some only by you. This page sets out the split so nothing falls between the gaps.
2. The split at a glance
| Area | Amazon Web Services | Indo Mail | You or your administrator |
|---|---|---|---|
| Data centres, hardware, power, physical access | Responsible | Chooses the Mumbai region and reviews AWS's controls | Nothing to do |
| Network and servers | Runs the underlying cloud network | Firewall rules, operating-system updates, HTTPS and mail TLS settings | Use networks you trust; avoid public computers for sensitive mail |
| Indo Mail software | Not involved | Secure development, automated tests before every release, fixing vulnerabilities | Keep the app and your browser up to date |
| Accounts and sign-in | Not involved | Password hashing, rate limits, 2-Step Verification, new-country alerts, activity monitoring | Strong unique passwords, 2-Step Verification, recovery email and phone |
| Mail filtering | Not involved | SPF, DKIM and DMARC checks, Indo Shield spam and virus filtering, scam warnings | Report spam and phishing; do not open unexpected attachments |
| End-to-end encryption keys | Not involved | Designs the encryption and stores only locked copies | Keep the devices that hold your keys safe; set a screen lock |
| Indo Passwords master password | Not involved | Never sees it and cannot recover it | Remember it or store it safely offline |
| Agent Inbox keys | Not involved | Scopes, rate limits, revocation, usage records | Give keys only to agents you trust; revoke keys you no longer use |
| Company domains (business accounts) | Not involved | Admin console, DNS check, sending limits | DNS records (MX, SPF, DKIM, DMARC), user accounts, who is admin, offboarding staff |
| Backups | Stores the encrypted backup copies | Nightly backups, 14-day retention, copies off the server | Download anything you must keep for legal reasons |
| Legal requests | Not involved | Checks every request against the law and our Law Enforcement Guidelines | Your company decides on its own retention rules |
3. What Indo Mail commits to
- Fix serious security problems quickly and tell affected people and the authorities where the law requires (including CERT-In within its deadlines).
- Keep data of Indian accounts in AWS Mumbai and list every service provider in the Privacy Policy.
- Never sell user data and never use mail content for advertising.
- Be honest about what we have not done: we hold no external security certification today.
4. What we cannot do for you
- We cannot protect an account whose password is reused elsewhere or shared.
- We cannot recover end-to-end encrypted mail on a new device that was set up after the mail arrived, or entries in Indo Passwords after a lost master password.
- We cannot undo mail you sent to the wrong person or remove copies from another provider's servers.
5. Contact
Questions: security@indoemail.in. Business administrators can open a case in the Support Center (indoemail.in/support).