Threat model
What we protect against — honestly.
Security means knowing who you are defending against. This page lists the risks we design for, what we do about each, and the risks we cannot remove, so you can decide what to share and how.
Protected
Risks we design for.
| Risk | What could happen | What Indo Mail does |
|---|---|---|
| Someone watching the network | Reading mail or passwords on public Wi-Fi | Every connection uses TLS; strict HTTPS everywhere; the app refuses unencrypted connections |
| A break-in at our servers | Copying stored data | End-to-end encrypted mail, subjects, chats, passwords and private details are stored only locked; the keys are never on our servers. Other data is encrypted in storage |
| Future quantum computers | Unlocking recorded traffic years later | Hybrid elliptic-curve and ML-KEM-768 keys for end-to-end encrypted mail |
| Phishing | Tricking you into giving away your password | Passkeys that cannot be phished, scam and phishing warnings, look-alike link checks in Indo Shield, and a Report phishing button |
| Account takeover | Someone signs in as you | 2-Step Verification, passkeys, backup codes, new sign-in alerts and signing out any device from Indo Shield |
| Tracking pixels | Senders learning when and where you open mail | Remote images are held until you allow them |
| Harmful attachments | Malware hidden in files | Risky file types are flagged and files are checked before you open them |
| A forwarded link to a secure message | Someone else opening it | Optional one-time code to the recipient’s address, a password lock, expiry dates and removing access at any time |
Not protected
Risks we cannot remove.
No email service can fully protect against these. Here is what you can do.
| Risk | Why we cannot stop it | What you can do |
|---|---|---|
| Malware or spyware on your own device | Messages are unlocked on your device, so anything that controls the device can read them | Keep your phone and computer updated, install apps only from trusted sources, and lock your screen |
| Recipients sharing what you send | Once someone can read a message, they can copy, photograph or forward it | Send sensitive things only to people you trust; use expiry dates for secure mail |
| Addresses, dates and sizes | Mail servers must see them to deliver mail | For very sensitive conversations, consider who could learn something just from the fact that you wrote |
| Mail that is not end-to-end encrypted | Mail to or from other services, unless password-locked, is readable on our servers and can be disclosed under a valid legal order | Lock sensitive mail with a password, or keep the conversation between Indo Mail accounts |
| A weak or reused password | Someone who learns it elsewhere can try it here | Use a passkey, or a long unique password with 2-Step Verification |
| Losing every device and your recovery details | We never have your end-to-end keys, so we cannot unlock old encrypted mail for you | Keep backup codes safe and stay signed in on more than one device |
Who we defend against
In plain words.
We design against criminals, scammers, network snoops and attackers who break into servers. We also design so that Indo Mail itself cannot read end-to-end encrypted content. We answer only valid legal orders through the proper legal process, and we publish how many we receive in our transparency report.
Want to go further?
Our privacy guide lists practical steps that take a few minutes.