SipherMail uses TLS in transit and is hosted in Europe. In Privacy mode, mail to other SipherMail users in Privacy mode is end-to-end encrypted automatically. Other mail, such as messages from other services and all mail of accounts in AI mode, can be read by the server. Further protection is something you turn on: expiring messages, two-factor sign-in and so on.
What to know first#
- Only end-to-end encrypted messages are unreadable to the server. See End-to-end encryption.
- Your login password can be reset. Your encryption passphrase cannot: only your recovery phrase can stand in for it. See Recovery email and passwords.
- For what SipherMail can and cannot see, read How we protect your data.
- Most account controls are in Settings > Security & 2FA on the web.
Which page do I need#
| You want to | Read |
|---|---|
| Encrypt a message so only the recipient can read it | End-to-end encryption |
| Send a message that expires or needs a password | Expiring and password-protected messages |
| Understand the email-first sign-in page, passkeys and single sign-on | Signing in |
| Protect sign-in with an authenticator app | Two-factor authentication |
| See where you are signed in | Sessions and devices |
| Limit what senders learn when you open mail | Image privacy |
| Plan for a forgotten password | Recovery email and passwords |
| Give a site an address that hides your real one | Masked emails |
| Understand the warning before a link opens | Link safety |
| Use Thunderbird, Apple Mail or Outlook | App passwords |
More on the product’s approach is on the Security page.
- End-to-end encryptionWhen mail is end-to-end encrypted automatically, how to set it up, and what the passphrase and recovery phrase are for.
- Expiring and password-protected messagesSend a message as a link that expires, with an optional password.
- Signing inHow the two-step sign-in page works on the web, and the passkey, password and single sign-on routes it offers.
- Two-factor authenticationProtect sign-in with an authenticator app, and what to do with backup codes.
- Sessions and devicesSee where you are signed in, sign out other sessions and manage trusted devices.
- Image privacyHow SipherMail removes known tracking pixels and loads remote images through its image proxy, and what that does not cover.
- Masked emailsGenerate random addresses that forward to your inbox, so a site never sees your real address, and switch one off to stop a sender for good.
- Link safetyHow SipherMail checks a link in a message before it opens on the web, which warning signs it looks for, and what it cannot tell you.
- Recovery email and passwordsReset a forgotten login password, set up a recovery email and recovery codes, and why the encryption passphrase is different.
- App passwordsCreate and revoke app passwords for connecting third-party mail apps over IMAP and SMTP.
- Vulnerability disclosureHow to report a security issue in SipherMail, what is in scope, what to expect from us and how we treat good-faith research.
- How we protect your dataWhat SipherMail can and cannot see in Privacy mode and AI mode, how data is stored, how long it is kept, and what we do not have yet.
- Sub-processorsThe types of outside service that can process personal data for SipherMail, what each can receive, and where it is located.
- PGP encryptionCreate or import a PGP key, publish it, and send or read signed and encrypted mail with other PGP users.
- S/MIME certificatesImport an S/MIME certificate, sign and encrypt mail with it, and understand what the trust labels mean.