Security you can check for yourself.
This page says exactly what Indo Mail protects, how, and where the limits are. Nothing here is a promise we cannot show in how the service works.
In transit, in storage, end to end.
They protect different things. Here is which is which.
In transit
Your browser, our apps and mail apps talk to Indo Mail only over encrypted connections (HTTPS with TLS 1.2 or 1.3, and TLS for IMAP and SMTP). Between mail servers we use STARTTLS whenever the other server supports it.
In storage
Drive, Photos and backup copies are kept in cloud storage encrypted with AES-256. The mail database is on our server in Mumbai. In both cases our systems hold the keys, so they can show you your mail and files, search them and check them for harmful content.
End to end
For mail between Indo Mail accounts, the message text is locked on your device and can only be unlocked on the devices of the people in the conversation. Our servers hold only the locked copy and never have the keys. Indo Chat messages work the same way.
Exactly what is covered.
End-to-end encryption is on by default and can be switched off in Settings. It applies only when every recipient is an Indo Mail account that has opened Indo Mail on a phone or computer; otherwise the message is sent with encryption in transit and you are told why.
| Part of a message | End-to-end encrypted between Indo Mail users? |
|---|---|
| Message text (the body you write) | Yes, when end-to-end encryption is on and every recipient has opened Indo Mail on a phone or computer |
| Subject line | No. It is protected in transit and stored on our server so your inbox can list and search it |
| From, To, Cc and Bcc addresses, date and size | No. Our servers need them to deliver the message |
| Attachments | No. They are protected in transit and stored on our servers, where our systems can read them so they can be previewed and checked for risky file types |
| Mail to or from other email services | No. It is protected in transit with TLS where the other server supports it, and stored on our servers |
How the keys work: each browser or phone creates its own key pair (ECDH P-256) the first time you use Indo Mail on it. The private key is created so that it cannot be copied out, and stays in that device’s storage. For every message, a fresh AES-256-GCM key locks the text, and that key is sealed separately for each device of each person in the conversation, including your own devices for your Sent copy.
Every layer, in plain words.
| Area | What Indo Mail uses |
|---|---|
| Website and apps | HTTPS only, TLS 1.2 and 1.3 with modern ciphers, HSTS with preload, and a strict Content Security Policy (no third-party scripts) |
| Mail between servers | STARTTLS on every connection that supports it, and SPF, DKIM and DMARC on indoemail.in. If the other server does not support STARTTLS, mail still goes, without encryption on that hop, as with every email service |
| Mail between Indo users | Optional end-to-end encryption, on by default: each device creates its own ECDH P-256 key pair; the message text is sealed with AES-256-GCM, and private keys never leave the device. Subject lines, addresses and attachments are not end-to-end encrypted. See what is covered |
| Passwords | Stored only as bcrypt hashes, never in readable form; at least 8 characters with a letter and a number |
| Sign-in | Passkeys (WebAuthn), 2-Step Verification with authenticator codes (TOTP) and one-time backup codes, sign-in with a code sent to your recovery email, and alerts for sign-ins from new devices |
| Files and backups | Drive, Photos and backup copies are kept in cloud storage with AES-256 encryption at rest. The mail database is on our server in Mumbai. Nightly backups are kept 14 days on the server, with a second copy in separate encrypted storage, all in Mumbai |
| PDF tools | Password protection with AES-256 and text recognition run on your own device; the file is not uploaded |
| Updates | Every release is tested automatically and goes live only after approval with a one-time code sent to the company’s approvers |
Protecting your sign-in.
Passkeys
Sign in with your fingerprint, face or screen lock instead of a password. Passkeys cannot be phished.
2-Step Verification
A 6-digit code from any authenticator app, after your password. Turn it on in Settings → Security.
Backup codes
Ten one-time codes for when your phone is not at hand. Each works once; making new codes cancels the old ones.
Sign in with an emailed code
A 6-digit code sent to your recovery email, valid for 10 minutes. 2-Step Verification is still asked for if it is on.
New sign-in alerts
An email when your account is used on a new device, with a link to secure the account.
Sign-in history
Your sign-ins and security changes for the past year, in Settings → Security.
How long things are kept.
Full details are on privacy details.
| What | How long |
|---|---|
| Messages you delete | In Trash for 30 days, then removed for good |
| Your whole account, after you delete it | Turned off at once and permanently deleted after 30 days, unless you sign in again to cancel |
| Nightly backups on the server | 14 days |
| Second backup copy in separate encrypted storage in Mumbai | Kept for disaster recovery. Automatic removal of a deleted account’s data from this copy is not yet in place; we are adding it |
| Sign-in history | 1 year |
What has been checked, and what has not.
Automated tests
More than a hundred end-to-end checks run before every release, covering sign-in, encryption, permissions and content security rules.
Daily health check
Every afternoon an automated check runs through every app and public page and reports problems to the team.
Approved releases
A new version goes live only after an approver confirms it with a one-time code.
Independent audit: not yet
No independent security audit or penetration test has been completed. When one is, we will publish its scope, date, findings and what we fixed here.
Blocklist watch
Our mail server and domain are checked against public spam blocklists every 6 hours.
Indian law
Cyber incidents are reported to CERT-In within 6 hours, and system logs are kept for 180 days in India.
Built on open source.
Indo Mail uses well-known open-source libraries under their licences. The full list is in our open-source licences file. The detailed design is in the security whitepaper.
Security FAQ
Is all my email end-to-end encrypted?
No. Only the message text of mail between Indo Mail accounts is end-to-end encrypted, and only when it is switched on (it is on by default) and every recipient has opened Indo Mail on a device. Mail to and from other email services cannot be end-to-end encrypted by us.
Can I search end-to-end encrypted mail?
Search on our servers finds these messages by subject, sender, recipient and date. Words inside the locked message text are not searchable on the server, because the server cannot read them.
Does Indo Mail scan end-to-end encrypted mail for spam?
The locked text cannot be scanned. These messages can only come from other Indo Mail accounts, which are protected by sign-up checks, daily sending limits and activity monitoring. The sender, subject line and attachments are still checked by the spam filter.
What happens to encrypted mail if I lose my phone?
Each message is locked to the devices you had when it arrived. If you lose every one of those devices, those messages cannot be opened, and we cannot unlock them for you because we never have the keys. Mail that was not end-to-end encrypted is not affected. See account recovery.
Has Indo Mail had an independent security audit?
Not yet. No independent security audit or penetration test of Indo Mail has been completed. When one is done, we will publish who did it, what was tested, the date, what they found and what we fixed, on this page.
Does Indo Mail hold ISO 27001, SOC 2 or a similar certification?
No. Indo Mail does not hold any security certification today. We will not show certification badges until we have them.
Found a security problem?
Tell us at security@indoemail.in. We reply within 2 working days.