This page describes how SipherMail handles your data, including the limits. SipherMail is operated by Sipher Ltd. Everything is hosted in Europe, including Sipher AI.
What can SipherMail see?#
It depends on the mode you chose and on who you write to.
| Kind of mail | Can the server read it? |
|---|---|
| Mail you receive from other services, and normal sends | Yes. It is stored on our mail server so you can read, search and sync it. |
| All mail of an account in AI mode | Yes. It is not end-to-end encrypted by default, so that Sipher AI can work on it. |
| Mail between SipherMail users who are all in Privacy mode, and other end-to-end encrypted messages | No. The body and attachments are encrypted on the sender’s device, and only the keys of the people on the message open them. |
| Subject lines, sender, recipients, dates and sizes | Yes, for every message. They are never end-to-end encrypted. |
| Expiring or password-protected messages with a password | No, when you set a password. Without one, anyone with the link can open it and so can the server. |
Your login password is stored as a hash. Passwords for connecting other mail apps are encrypted at rest. Your encryption private key is stored already encrypted with your passphrase.
Storing ordinary mail in a form the server cannot read is planned. It is not available today, and we do not claim it.
What the recovery phrase is for#
Your login password can be reset with your recovery email or a recovery code. That does not unlock end-to-end encrypted mail, because its key is protected by your encryption passphrase, which we never have. The recovery phrase is 12 words that can unlock that key on a new device. If you lose both the passphrase and the recovery phrase, nobody can open that mail, including us.
What we log#
We record sign-ins and other security events with the IP address and the browser or device used, and we keep the IP address and device details of each signed-in device. You can review and sign out devices under Sessions and devices. A new-mail push notification carries no sender, subject or message text; the app fetches the message itself.
Who can access it#
The admin tools in the app have no feature for reading a member’s mail. An organisation admin can choose to transfer a leaving member’s mailbox to another member. People who run our servers have technical access to the systems, so ordinary mail is not hidden from the operator. Encrypted messages are.
AI processing#
Sipher AI runs on a model hosted on SipherMail’s own servers, not with a third-party AI provider. Privacy mode turns all Sipher AI features off. See Sipher AI privacy.
By default, Sipher AI keeps this data for a limited time:
| Data | Default retention |
|---|---|
| Chat history | 90 days |
| Summaries and extracted entities | 30 days |
| Label-learning samples | 30 days |
| Prompt logs | 7 days |
These are defaults and can change.
How long other data is kept#
- Sign-in sessions on the web last up to 30 days.
- Message trace records for organisations are deleted after 90 days.
- Deleting your account starts a 30-day period in which you can cancel. After that the account is removed.
In transit and backups#
Connections to the web app and to our mail server use TLS. Traffic between our own systems uses a private network. Database backups are encrypted before they leave the server and are stored in a separate location.
What we do not have yet#
- We do not have a SOC 2 or ISO 27001 report today.
- We have not published an independent security audit.
To report a problem, see Vulnerability disclosure. The services we use are listed under Sub-processors.