mailpitcher

Security

You connect real mailboxes to Mailpitcher, so here is what protects them, what is stored in readable form, and where it all runs. No badges we haven't earned: we hold no SOC 2 or ISO 27001 certification today.

Mailbox passwords and tokens

  • Mailbox passwords, app passwords and Microsoft sign-in tokens are encrypted with AES-256-GCM before they're stored, and decrypted only to connect to your provider. The key is kept on the server, apart from the database and its backups.
  • With Gmail you use an app password, which you can revoke in your Google account at any time without changing your main password. Outlook and Microsoft 365 connect with "Sign in with Microsoft": Mailpitcher never sees that password.
  • Two-step sign-in secrets, email bodies, emails waiting to be sent and attachment files are encrypted the same way. Message bodies are kept for 30 days, then fetched again from your provider when you open them.
  • Stored readable, so lists, search and sorting work: email metadata (subject, sender and recipient addresses, dates, folders and a short preview), contacts and their imported columns, project boards, templates and signatures.

Signing in

  • There are no Mailpitcher passwords. You sign in with a one-time link by email, valid for 10 minutes (or with Google, where it's offered).
  • Two-step sign-in (an authenticator app, with backup codes) is required before you connect a real mailbox or send anything, on every account. You choose how often a trusted device is asked for a code again.
  • Sign-in requests are rate limited per address, and the sign-in page answers the same whether or not an address has an account.

Sessions

  • A session lasts at most 30 days, and ends sooner if the browser goes unused for two weeks. Session cookies are Secure and HttpOnly, and only a hash of the token is stored.
  • Settings → Security lists where you're signed in, and signs out any of them. Turning two-step sign-in on or off signs out every other device.
  • AI assistants connect through the MCP server with a personal token: stored only as a hash, it stops working after 90 days, or after 30 days unused, and you can revoke it any time. What an assistant sends waits for your approval unless you allow otherwise.

Where your data is, and who processes it

  • Our servers and database run with DigitalOcean in Frankfurt, Germany (EU). Connections to mail providers pass through a relay in Frankfurt (Vultr), which sees only encrypted traffic. Your mail itself stays with your provider; Mailpitcher keeps a working copy.
  • Every connection is encrypted: HTTPS for the app, TLS (required) to IMAP and SMTP servers.
  • The full list of companies that process data for us, with their locations and transfer safeguards, is in the Privacy Policy. Customers get a GDPR article 28 Data Processing Addendum, including sub-processors and breach notification.

Who can see what

  • Every request is checked on the server against your account: no account can reach another one's mailboxes, contacts or outreach.
  • Our staff don't read your messages. The admin tools never show message content (subjects, bodies, senders or recipients). The exceptions, kept to the minimum, are in the Terms of Service: when you ask us to for support, a security incident or credible abuse report, or a legal requirement.
  • Server access is by SSH key only, and the services run as a restricted user that can't change their own code.

Backups and deletion

  • The database is backed up every night, and DigitalOcean keeps backup copies of the server in the same EU data centre. Every backup is gone within 30 days.
  • You can download all your data at any time in Settings → Plan & account → Download your data. Deleting your account switches it off at once; everything in it is erased 24 hours later.

Report a vulnerability

Found a security problem? Email hello@mailpitcher.com with "Security report" in the subject: what you found, how to reproduce it, and what it could affect. A person reads every report and replies within 1–2 working days. Please don't access other people's data, run denial-of-service or spam tests, or test against mailboxes you don't own. We have no paid bug bounty. Our contact details are also in security.txt.

To report spam or abuse sent with Mailpitcher, write to abuse@mailpitcher.com instead.

Security in the Privacy Policy