Reference
Security and privacy
Built by a founder with two decades in cybersecurity.
Your account
- Passkeys (Face ID, Touch ID, fingerprint), authenticator apps and recovery codes
- Sign-in protection against repeated guessing
- New sign-in alerts, recent sign-ins and "sign out everywhere"
- App passwords for mail apps, revocable any time
Your mail
- Every connection encrypted, with strict delivery security per domain
- Sender authentication ready for every domain
- Spam and virus filtering, quarantine, safe links at click time
- Tracker and picture privacy; look-alike sender warnings
- Protected email and S/MIME
Your company
- Company 2-step and password rules (Seal and Crest)
- Managed devices with approval and remote wipe of MailOfficially app data
- Admin security alerts and a full activity log
- Office / VPN-only access, SSO, DLP, archive and legal hold (Crest)
Your data
- Hosted on Amazon Web Services in the United States; Drive files stored encrypted
- No ads, no selling data, no ad profiles from your mail
- EMA reads email only for the EMA features that are on, and your data never trains AI
- HIPAA safeguards on Crest, with a signed Business Associate Agreement
- Deleted mailboxes: a backup is kept for 30 days, then erased
- Download all your data any time
What these protections don't do
- Remote wipe: removes MailOfficially app data only. Mail already downloaded to another mail app, or saved elsewhere, stays where it is.
- Protected email: expiry stops new opens; it cannot take back a copy someone has already read, saved or printed.
- Safe links and sender warnings: catch most known threats, not every one. Report anything suspicious.
- Healthcare: our safeguards and BAA support your HIPAA program; your own policies, training and risk reviews are still needed.
No advertising. No selling of data. Your mail is yours.