Trust & Safety

1. Why Trust & Safety matters at Indo Mail

Email is one of the most trusted tools in a person's life. It carries bank statements, job offers, school results, medical reports and conversations with family. That trust is also what criminals try to borrow. A scam message that lands in a real inbox is far more likely to be believed than one that arrives anywhere else.

Indo Mail is an email and productivity service from INDO CHATS PRIVATE LIMITED. This page explains how our Trust & Safety work is organised. It covers how we find abuse, how we decide what to do about it, how quickly we act, and how you can challenge a decision you think is wrong.

It should be read together with our Acceptable Use Policy, Terms of Service, Privacy Policy, Child Safety page and Safety Center. If this page and the Terms of Service differ, the Terms of Service prevail.

2. Our principles

Every decision made by our Trust & Safety team is guided by the same short list of principles.

• Protect people first. Where a message or account puts someone at real risk, such as a child, a victim of fraud or a person being threatened, we act first and discuss afterwards.
• Privacy is not a casualty. We do not read your mail to find out what you are writing about, and we never use mail content to target ads. Our safety checks look at technical signals, sender reputation and patterns of behaviour. Where a person reviews content, it is because someone reported it or because a legal duty requires it.
• Act in proportion. A first-time mistake by a small business is not treated like organised fraud. We use the lightest response that actually stops the harm.
• Be fair and consistent. The same rules apply to every account, whether it is free or paid, personal or business.
• Explain our decisions. When we limit or close an account we tell the account holder why, unless the law or an active investigation stops us from doing so.
• Follow the law of India. We act under the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (as amended), and we cooperate lawfully with Indian authorities.
• Keep improving. Abuse changes every month. We review what slipped through, what we blocked by mistake, and adjust.

3. What we treat as harmful

The detailed rules are in the Acceptable Use Policy. In summary, Trust & Safety work concentrates on these areas:

• Phishing, fake sign-in pages, fake KYC, fake job, refund and investment scams, and impersonation of banks, government bodies or individuals.
• Spam, bulk unsolicited mail and mail sent without a valid way to opt out.
• Malware, links to malware and attachments designed to take over a device.
• Child sexual abuse material and any sexual content involving minors, which we treat with zero tolerance.
• Sharing or threatening to share intimate images of a person without consent, and sextortion.
• Harassment, stalking, threats of violence and content that incites violence.
• Use of Drive share links, Business Profiles or ads to host or promote any of the above.
• Attempts to break into accounts, abuse of the service or evasion of limits and earlier enforcement.

4. How we detect abuse: automated systems

Because millions of messages are too many for any team to inspect by hand, most detection is automated. These protections are live on Indo Mail today:

• Sender authentication. Every incoming message is checked against the sender's SPF, DKIM and DMARC records. A message that fails is delivered to Spam rather than your inbox.
• Scam and phishing warnings. When a message shows signs of phishing or fraud, Indo Mail displays a warning banner above it that gives the reasons, such as a mismatched sender or a link that does not go where it claims. The banner includes a Report scam button so you can tell us in one tap.
• Safe message display. The HTML in every message is sanitised, and remote images stay blocked until you choose to show them.
• Sending limits and monitoring. Each account can send at most 500 messages a day. A sudden burst of outgoing mail, a high bounce rate or many complaints raises an alert.
• Sign-in protection. Repeated failed sign-ins are rate-limited. Every sign-in is recorded with its time, IP address and device, and account owners can see their own history under Settings, then Sign-in history. 2-Step Verification, using codes from an authenticator app, is available to every account.
• Ad review. Every ad is reviewed before it runs. Political ads are not accepted.
• Security monitor (from release 2.0.0): every 5 minutes it checks activity records for password guessing (10 or more failed sign-ins in 15 minutes), many new accounts from one network in 24 hours, an account sending to most of its daily limit within an hour, many bounces in 24 hours, spam reports from other Indo Mail users and chat flooding. Each pattern raises at most one alert per account per period. High-severity alerts are emailed to the security team and listed in Admin console → Security alerts. Bounce and spam-report alerts pause sending to other providers for 24 hours pending review. Message content is never read.

Automated systems make mistakes in both directions. They may miss something harmful, and they may flag something harmless. That is why every automated action that affects an account can be reviewed by a person if you appeal (see section 9).

5. How we detect abuse: people and reports

Technology finds patterns. People understand context. We rely on human judgement for the following:

• User reports. The Spam and Report scam buttons in the inbox, and reports sent to abuse@indoemail.in, are the most valuable signal we have. A report is read by a person when it concerns safety, legality or an account decision.
• Trained reviewers. Reviewers are given written guidelines, regular refreshers and a route to ask a senior colleague when a case is unclear.
• Trusted flaggers and partners. We welcome reports from banks, brands, child-protection groups and security researchers, and treat them carefully because they often include evidence we cannot see ourselves.
• Government and court orders. Lawful notices and orders are handled by our legal function, as described in section 10.
• Security research. Weaknesses in Indo Mail itself should be sent to security@indoemail.in.

When a reviewer needs to look at message content, we limit what is opened to what is needed to decide the case, record that it was opened and why, and restrict access to authorised staff.

6. Our review process

Whether a case begins with an automated alert or a user report, it follows the same path.

• Triage. Each case is given a priority. Risk to children, threats to life and intimate-image abuse come first, followed by active fraud, then malware, then everything else.
• Evidence. The reviewer collects what is needed: message headers, links, sending history, earlier reports and sign-in data for the account.
• Decision. The reviewer applies the Acceptable Use Policy and the law. Serious or unclear cases are checked by a second person.
• Action. The reviewer applies the response described in section 8, and the account holder is notified when it is safe and lawful to do so.
• Record. The decision, the reason and the evidence are kept so that an appeal can be decided fairly and our consistency can be checked.

7. How fast we respond

These are the response targets we work to. They are targets for first action, not promises that every case will be fully resolved in that time, because some need evidence from other parties.

8. The enforcement ladder

We choose the lightest action that stops the harm. Where a case is serious, we start higher up the ladder, or skip rungs entirely.

Paid-plan customers who lose an account for breaking the rules are not entitled to a refund for the period remaining, except where the law says otherwise. We will always give you a reasonable chance to download your own files when the law and safety allow it. We will not allow that where the files themselves are the evidence of a serious offence.

9. Appeals

If you think we made a mistake, you can ask us to look again. You do not need a lawyer.

• Reply to the notice we sent you, or write to support@indoemail.in from any address, quoting your Indo Mail address and the date of the action.
• Say briefly why you believe the decision was wrong and add anything that helps, such as proof that the business is genuine or that the account was hacked.
• A different reviewer, who was not involved in the first decision, looks at the case afresh and replies within 7 days.
• If the decision is reversed, access is restored promptly and any limits are removed.
• If it is upheld, we tell you why in plain words.

Appeals about child sexual abuse material, and cases already with the police, may be declined where the law requires. If you are still unhappy after an appeal, you can complain to the Grievance Officer (section 11). You also keep your right to approach the courts and any statutory appellate body, such as the Grievance Appellate Committee under the IT Rules, 2021, where it applies.

10. Working with authorities

We cooperate with Indian law enforcement, courts and regulators, and we protect users from requests that are unlawful or too broad.

• Lawful requests only. Requests for user information must be sent to legal@indoemail.in on official letterhead, citing the legal power relied on, such as section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023 or a court order. We check each one before responding.
• Minimum disclosure. We provide only what the request lawfully requires.
• Emergencies. Where life is at immediate risk, we may share limited information without delay and then expect the formal paperwork.
• Preservation. On a valid request, or where we find serious offences ourselves, we preserve records so evidence is not lost.
• Mandatory reporting. We report child sexual abuse material as required by the Protection of Children from Sexual Offences (POCSO) Act, 2012, and report cyber incidents to CERT-In within 6 hours as required by its Directions of 28 April 2022. Logs are kept in India for one year.
• Notice to users. Where lawful, we tell the account holder about a request. We do not do so where the law forbids it, where it would endanger someone, or where it would harm an investigation.

Our Law Enforcement Guidelines explain this process in more detail. Please do not send law-enforcement requests to support addresses.

11. Grievances under the IT Rules, 2021

As an intermediary, Indo Mail has appointed a Grievance Officer. You may complain about content, about an action we took, or about how we handled a report.

• Who: Salena, Grievance Officer, INDO CHATS PRIVATE LIMITED, 168, GT Rd, near Aloka Cinema, Shibpur, Howrah, West Bengal 711102, India.
• How: email grievance@indoemail.in. Please give your Indo Mail address, a clear description of the problem and any links or evidence.
• Acknowledgement: within 24 hours of receipt.
• Resolution: within 7 days of receipt.
• Intimate imagery: a complaint that content shows a person in nudity or a sexual act, or is a morphed or impersonating image of that kind, made by that person or on their behalf, is acted on within 24 hours of receipt, usually by removing or blocking access to it.

Complaints are recorded and tracked until they are closed. We tell you the outcome and the reasons.

12. Transparency and accountability

We believe people should be able to see how we use our powers. We intend to publish a periodic transparency report that will include the number of abuse reports received, the actions taken by category, the number of appeals and how many were successful, and the number of government and court requests received and how many we complied with. We will publish figures only when they are accurate and large enough not to identify individuals.

We do not currently hold any external security or privacy certification. ISO 27001 and similar certifications are planned, and we will not claim them until they are awarded.

We also review our own work. Senior managers regularly examine samples of decisions, look at the appeals we lost, and use the findings to correct guidelines and training.

13. Looking after our Trust & Safety team

The people who review abuse reports see distressing material. Looking after them is part of doing the job responsibly, and it makes their decisions better.

• Reviewers are told what to expect before they start and may decline particular types of work.
• We limit exposure by using automated blocking and hashing where possible, so that people see less harmful content.
• Reviewers work in rotation, with regular breaks and no targets that reward speed over care.
• Confidential counselling and wellbeing support is available to them, during and after their employment on this work.
• Managers check in with reviewers regularly, and any reviewer can ask for a case to be passed to someone else.

14. What you can do

• Use Report scam and Spam in your inbox. It takes one tap and helps everyone.
• Turn on 2-Step Verification and keep your mobile number up to date.
• Never share an OTP, UPI PIN or password with anyone, including people who say they are from Indo Mail.
• Report anything serious to abuse@indoemail.in, and mark it URGENT if a child or an intimate image is involved.
• If you have lost money to fraud, call 1930 or report at cybercrime.gov.in straight away.

15. Contact

Report abuse, scams or harmful content: abuse@indoemail.in. Report a security weakness: security@indoemail.in. Account help and appeals: support@indoemail.in. Complaints under the IT Rules, 2021: Salena, Grievance Officer, INDO CHATS PRIVATE LIMITED, grievance@indoemail.in. Law-enforcement and court requests: legal@indoemail.in.

This document is governed by the laws of India.