Security model · Server 0.115 · Android 0.4.0
What protects your mail, layer by layer.
This page lists the protections in the current release and what each one stops. The core is open source under AGPL-3.0-or-later, so anyone checks the code behind each claim.
Sign-in
OPAQUE password-free sign-in
Your device and the server run the OPAQUE protocol. The server stores a record it cannot reverse into your password, and your password never crosses the network. Once an address signs in with OPAQUE on a device, that device never falls back to sending the password.
Passkeys
WebAuthn passkeys replace the 6-digit code with your fingerprint, face, phone or a security key. A passkey answers only to the real EndPaper site, which defeats look-alike sign-in pages.
Authenticator codes that fail closed
The database records which accounts turned on two-step sign-in. If the code settings or files go missing, sign-in stops instead of accepting the password alone. Wrong codes lock sign-in for 15 minutes.
Sessions and cookies
Web sessions end after 30 minutes. The session cookie uses the __Host- prefix with SameSite=Strict, and every change carries a CSRF token.
Password rules
Mailbox passwords need 16 to 128 characters with uppercase, lowercase and digits. The page refuses common passwords, keyboard runs and passwords built from your name or address, and offers an on-device generator.
Account recovery
Password resets go only to a recovery email you verified in advance, with a 4-digit code valid for 10 minutes. We never send a reset to a new, unverified address.
Encryption
Post-quantum keys on your device
Setup creates ML-KEM keys (768 and 1024 bit levels) on your phone or in your browser. Only the public half leaves the device. You protect the private half with a passphrase of 12 characters or more.
OpenPGP and MLS
OpenPGP covers encrypted mail with other providers. MLS key packages and queues carry encrypted messages between EndPaper users.
Sealed on arrival
The inbound gateway seals each message for your address as it arrives. The stored copy opens only on devices that hold your keys. Deleting a sealed message removes the only copy.
24-word recovery
Setup gives you 24 recovery words and a recovery file. Keys publish only after you confirm you wrote the words down. An optional copy of the file on EndPaper opens only with the words, which we never see.
Signed key log
Every published key enters a signed, append-only log. Your devices check signatures, size and consistency proofs at each visit, refuse a log that shrank or changed history, and compare a short code across devices.
Protected message portal
Send an encrypted message to someone without EndPaper. They open it on a protected page and reply there.
Servers and data
Forced row-level security
All 29 tables that hold account data enforce PostgreSQL row-level security, and schema revision 28 forces the same rules on the table owner. A bug in one request path cannot read another tenant's rows.
Separate database roles
The web service, the mail gateway and the outbound sender each sign in with their own role. None of them owns tables or bypasses row security.
DANE and verified TLS
The mail gateway checks DANE records where the other domain publishes them. IMAP requires TLS 1.2 or newer.
Locked-down services
Services run as an unprivileged user with no new privileges and a read-only system. Admin ports answer only from one approved address, and FTP is closed.
Attachment scanning
Attachments pass a ClamAV scan on download. A file with a detected threat, or a failed scan, does not download.
Servers in the United States
Hosted mail runs on a server in Phoenix, Arizona, in the United States. United States law applies to the data stored there.
In your browser and on your phone
Strict browser policy
The webmail sends a Content Security Policy with Trusted Types, blocks framing, sends no referrer and denies camera, microphone and location. HSTS keeps every visit on HTTPS for a year.
Remote images off by default
Messages open with remote images blocked. When you allow them, they load through an image proxy, so senders do not see your IP address or device.
Android hardware keystore
Saved secrets are sealed with AES-256-GCM using a key held in the phone's Android Keystore. Each value is bound to its own name, so a copied value fails to open.
No backups, no plain HTTP
The Android app excludes its data from cloud backup and device transfer, refuses plain HTTP and does not follow redirects.
Safe message view
The Android reader shows mail with JavaScript, file access and forms turned off. Network loads stay off unless you allow remote images, and then only over HTTPS.
Your own mail provider
The Android app also connects straight to Gmail, Yahoo, iCloud, AOL, Fastmail, Zoho, GMX or any IMAP provider over verified TLS, with no EndPaper server in between.
Who runs EndPaper Mail
The company
EndPaper Mail is built and run by Alien Tech Services LLC, a company registered in Washington State, United States.
Where your mail is stored
On a server in Phoenix, Arizona, in the United States. Mail sealed with your keys stays sealed there, because the server never holds the keys that open it.
Source code
The core of EndPaper Mail is open source under the AGPL-3.0-or-later license.
Independent audit
No independent security audit has been completed yet. When one is booked, this page will name the auditor and the date, and the report will follow when it is done.
Report a security problem
Write to security@endpapermail.com with the steps to reproduce the problem.