Security
Your mail is yours. We built it that way.
A mail client sits between you and your most private messages. This page explains, in plain language, how Senin Mail protects them, and where the limits are.
- AES-256-GCM at rest
- Per-user isolation
- Sandboxed HTML
Principles
How we think about your data
Four rules that shape every decision.
Least access
We ask providers for the narrowest permission that does the job, and nothing more.
Nobody else's business
Every request is checked against the signed-in user. There is no shared mailbox.
Secrets stay secret
Tokens and passwords are encrypted before they are stored and are never shown again.
Delete means delete
Disconnect an account and its credentials and cached mail are removed.
Credentials
Your passwords and tokens are encrypted
Google and Microsoft accounts connect with OAuth, so Senin Mail never receives your password. The tokens it does receive, and any IMAP app password, are encrypted before they reach the database.
- AES-256-GCM authenticated encryption with a fresh random IV for every value
- Versioned encryption keys, with a documented rotation process and a tool that re-encrypts everything
- OAuth sign-in is bound to your browser and your session, which blocks account-linking attacks
- When you disconnect a Google account, its token is revoked at Google
Stored value
k2.Qm9k…IV.7Hc2…TAG.xT1u…ciphertextA key id, a random IV, an authentication tag and the ciphertext. Tampering with any part makes decryption fail.
Isolation
Every request is checked, every time
Each API call confirms who you are and which accounts belong to you before it touches any data. Messages, folders, drafts, attachments and downloads are all scoped to your own accounts, and this is covered by automated tests that try to cross the line.
- Opening someone else's message, attachment, draft or folder returns “not found”
- Deep links like /inbox/<id> only work for the account that owns the message
- Replies and moves can only reference your own messages and folders
- Uploads are private to you and are deleted after sending or after 24 hours
No request can cross this line.
Safe reading
Other people's emails can't hurt you
Email is a popular way to attack browsers. Senin Mail treats every message as untrusted.
Sanitised HTML
Scripts, forms, embedded frames, style sheets and anything that could run code are stripped before a message is stored.
Sandboxed display
Messages appear in a sandboxed frame with scripts disabled and a strict content policy, even if the sanitiser missed something.
Remote images blocked
Tracking pixels can't tell a sender you opened their mail until you choose to load images.
Links open safely
Links open in a new tab without giving the destination access to Senin Mail.
Careful downloads
Attachments download rather than run, with content-type sniffing off. Only images and PDFs preview inline.
Hostile names handled
Filenames and headers are cleaned so they can't be used to smuggle anything.
Controls
What protects what
A short list of the safeguards that run in production.
| Threat | Control |
|---|---|
| Stolen database | Credentials are encrypted with AES-256-GCM; keys are separate from the data |
| Cross-site request forgery on sign-in | OAuth state is signed, short-lived and tied to your session and browser |
| Malicious HTML in email | Server-side sanitising + sandboxed frame + content security policy |
| Tracking pixels | Remote images blocked by default |
| Server-side request forgery | IMAP and SMTP hosts on private networks are refused |
| Password guessing | Rate limits on sign-in, sign-up, sending, uploads and connection attempts |
| Header injection in sent mail | Messages are built with a proper MIME library, never by string concatenation |
| Session theft | HTTP-only, same-site session cookies |
Data lifecycle
What happens to your data, step by step
You connect
You approve access. Tokens or passwords are encrypted and stored.
We sync
Message details (sender, subject, preview, date, flags) are cached so your inbox loads quickly. Bodies are fetched when you open a message.
You work
Attachments you add are held privately for at most 24 hours. Drafts are saved in your own mailbox.
You leave
Disconnect an account and its credentials and cached messages are deleted. Delete your Senin Mail account and everything goes.
Policies
Plain commitments
What we do and don't do with data from your accounts.
Google API Limited Use
Our use and transfer of information from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
No ads, no selling
We don't sell your data, use it for advertising, or train general AI models on it.
Human access
People at Senin Mail don't read your mail unless you ask for support, or it is needed to investigate abuse or comply with law.
Honest status
During early access, Google shows an “unverified app” notice because verification is still in progress. We say so rather than hide it.
Responsible disclosure
Found a vulnerability? Please tell us
We take reports seriously and will respond as quickly as we can.
Email the details, including steps to reproduce, to
security@softexsolution.com- Please give us a reasonable chance to fix an issue before sharing it publicly.
- Don't access, change or delete other people's data while testing.
- No denial-of-service or social-engineering tests.
- We're happy to credit you once it's fixed, if you'd like.
Questions