Security

Last updated 2 October 2026

Cusentra Mail holds people's email, so security is not a feature we add on; it is how the product is built. This page says plainly how your mail is protected, what we do not yet have, and how to tell us about a weakness.

1. How your mail is protected

• Stored in the EU. Our servers and database run in the European Union (Frankfurt, Germany).
• Encrypted with a key of your own. Subjects, bodies, previews, the text of the search index, your notes and drafts, and every password and token you give us are encrypted with AES-256-GCM under a key that belongs to your account, which is itself encrypted by a master key kept outside the database. Someone who copied the database would see ciphertext.
• Encrypted on the way. Every connection - your browser, our database, Gmail, the AI providers - uses TLS.
• Kept apart from other accounts. Every request and background job is tied to one account, and every database query is filtered by it.
• Search without sending your text away. The search index is computed on our own servers; voice dictation runs inside your browser.
• AI only when you ask, and never for training. AI features read your consent first and can be switched off; what is sent is only what a task needs; nothing is used to train models.
• Deleted means unreadable. Deleting your account destroys its encryption key, so even backups of its mail can no longer be read.
• A record that cannot be quietly changed. Security-relevant actions go into an append-only, hash-chained audit log kept for 24 months.
• No trackers. No analytics, advertising or tracking code runs on our pages (Cookie Policy).
• Hardening. Forged-request protection on every action, throttled sign-in, mail sanitised before it is shown, web addresses checked before we fetch them, and an automated test suite of several thousand tests run before every change.

2. What we do not claim

• We do not hold an ISO 27001 or SOC 2 certificate of our own. Our hosting and database providers do, for the data centres your data is in.
• Two-factor sign-in to Cusentra Mail itself is not available yet. Please use a strong, unique password, and turn on 2-Step Verification for your Google account.
• Some details are not encrypted, because the inbox needs to sort and filter by them: email addresses, dates, labels and flags. The search index's numeric vectors are stored as numbers.

The full technical description is in our Data Processing Agreement's Annex II.

3. If something goes wrong

If a security incident affects your personal data, we tell you without undue delay when it puts you at risk, in plain words, with what to do. We tell organisations that use the Service within 48 hours, the regulators where the law requires within 72 hours, and India's CERT-In within 6 hours of the incidents its rules list.

4. Report a vulnerability

If you think you have found a security weakness in Cusentra Mail, please tell us at danish@cusentra.com. Include what you found, how to reproduce it, and what an attacker could do with it. We reply within 3 business days, keep you updated, and tell you when it is fixed.

In scope: this website and the Cusentra Mail application. Out of scope: denial-of-service, spam or volume testing; social engineering or phishing of our team or users; physical attacks; the services we rely on (report those to Google, Paddle, Supabase or Amazon); and automated scanner output or missing best-practice headers without a demonstrated impact.

Safe harbour. If you act in good faith within these rules, we will not take legal action against you or ask anyone else to. The rules: test only against accounts you own or have permission to use; never access, change or keep other people's data beyond the minimum needed to show the problem, and tell us at once if you reach any; do not degrade the Service for others; and give us reasonable time - normally 90 days - to fix the issue before you disclose it.

Thanks. We do not pay bounties. With your permission, we thank you by name on this page once the issue is fixed.

5. Thanks

No reports yet. The first name here could be yours.

Machine-readable contact details are at /.well-known/security.txt.