Security & privacy

Security is built into how NevTan Mail works. This page summarizes the essentials; the full details are in the Privacy Policy and Terms of Service.

How your data is protected

• Everything in transit is encrypted. Traffic between your browser and NevTan Mail travels over TLS.
• Access is by password and session. Signing in issues a session that is checked on every request.
• Roles decide what each person can reach. Admin screens, other people's mailboxes and the subscription are closed to accounts without the role for them — see Admin overview & roles.
• Mail you send is authenticated. SPF, DKIM and DMARC on your domain let receivers confirm a message really came from you, which is what stops others sending in your name — see DNS records & email authentication.
• Incoming junk is filtered into Spam rather than your inbox.

Protecting your sign-in

Most attacks on a mailbox are attacks on its password, so several protections sit around the sign-in screen:

• Repeated wrong passwords lock the account. Five inside fifteen minutes and sign-in is refused for that account until the fifteen minutes are up — see You can't sign in.
• Sign-in, signup and password-reset requests are rate-limited by where they come from, so the screens cannot be hammered from one place.
• The error message never reveals whether an account exists. A wrong password and an address with no account both answer Invalid email or password, so the screen cannot be used to find out who has a mailbox.
• Resetting your password ends your other sessions. Anything already signed in with the old password is cut off, which is what makes a reset useful after a device is lost.
• Admins can see every attempt. Successful and failed sign-ins are recorded with the address, result, method, IP address and device — see Audit log.

Your email content

• Your mail is not read for advertising. There is no advertising in NevTan Mail, so there is nothing to target.
• It is processed to run the service — delivering and displaying messages, filtering spam, and keeping the system secure. Nothing beyond that.
• You can restrict a message yourself. Confidential mode sends the body as an expiring link rather than as ordinary mail — see Confidential mode for what it does and does not protect against.
• API keys are stored as a one-way hash. A key you create cannot be read back out by anyone, which is why it is shown once and why revoking is immediate — see API keys.
• The full account is in the Privacy Policy, including what is kept and for how long — see Privacy Policy.

Connected Google data

Connecting your Google account is optional and used only for calendar and meeting features. NevTan Mail requests only the access those features need, never sells your data, and doesn't use it for advertising. You can disconnect at any time, which deletes the stored authorization. See Connect Google Calendar.

Report a security issue

Found a potential vulnerability? Please report it responsibly to info@nevtan.com with a description of the issue, and give us a chance to investigate before disclosing it publicly.