Security at SuperMailbox

Security disclosure updated October 16, 2026.

Mailbox credentials

• iCloud users provide an Apple app-specific password. SuperMailbox does not ask for the primary Apple Account password.
• Mailbox credentials use envelope encryption with AES-256-GCM. A separate random data key encrypts each credential payload; the data key is itself encrypted with a wrapping key stored in Yandex Lockbox.
• The API does not receive the credential wrapping keys. A separate private mail worker uses them to decrypt credentials only for authorized mailbox operations.
• Disconnecting a mailbox or completing account deletion clears its stored credential and connection settings from the active database.

Infrastructure and access

• SuperMailbox runs on Yandex Cloud. MongoDB persistence and the OpenSearch mail index use authenticated private network connections; their database ports are not exposed by the public application.
• Caddy is configured to serve the website and API domains over TLS. The API and mail worker communicate over an authenticated, signed private RPC boundary.
• The mail worker is separate from the public web and API services. Message lists and opened bodies use a bounded, encrypted database cache with expiry 24 hours after the last foreground use. Attachment bytes are fetched on demand and are not cached.
• Database backups are encrypted separately before upload to a private Yandex Object Storage bucket. Application backup access uses the VM's upload and restore identity, and the bucket has a configured 30-day lifecycle.
• The application records audit metadata for security-sensitive operations without storing message bodies or attachments in those audit records.

Accumulated mail index

SuperMailbox's accumulated mail index and semantic search are currently enabled at service level for all active accounts. The index uses only messages loaded during normal mail activity and bounded background checks of eligible connected inboxes. Background checks can prefetch a limited number of unread Inbox message bodies before you open them; that text can be indexed and processed for semantic-search embeddings. The service does not crawl every folder. Credentials and OAuth tokens will not be indexed. Indexed fields can include metadata, subject, already-loaded plain text, and vectors. Attachments, images, audio, and video are excluded; remote images are not fetched and OCR is not enabled. The 1 GiB per-user quota is a logical limit covering metadata, text, and vectors, not a physical storage limit.

MongoDB staging payloads for this feature are encrypted with AES-256-GCM. OpenSearch stores the searchable message fields and vectors; the staging encryption statement does not describe OpenSearch storage encryption. A mailbox disconnect or account deletion will block the affected mailbox generation from new results and queue physical index cleanup, with retries until deletion is confirmed. Minimal opaque deletion records contain no mail body and are retained to prevent removed data from returning after recovery. Existing encrypted MongoDB backups may retain staged ciphertext until their configured 30-day expiry; backup restoration must replay deletion records before indexed mail is served.

Operational limits

Core service logs are size-limited to three rotated 10 MB files per service. Private monitoring metrics are configured for 15 days with a 2 GB size cap. Billing, authorization and client-registration metadata, audit events, and mail-send operation records currently do not have automatic purge periods in the application database. Existing encrypted backups are not rewritten when an account is deleted. See the Privacy Policy for the deletion details.

Report a security issue

Email suspected vulnerabilities or unauthorized access to abalchunas@hardtab.com. Please include steps to reproduce the issue and its potential impact. Do not include mailbox passwords, sign-in links, message contents, or access tokens. HARD TAB LLC does not currently publish a bug-bounty program, public status page, or guaranteed response time for reports.

No independent security certification or penetration-test result is represented on this page. We will update this page if our controls or reporting arrangements materially change.