Security

App passwords instead of your mail password

Gmail lets you create a separate app password, and Onet does when you use two-step verification. Such a password works only in mail programs, and you can revoke it with your provider at any time. multiboxi then loses access, and your main password stays the same.

Some providers (such as DreamHost) do not offer app passwords. Then you connect the mailbox with its own password.

Encryption

Mailbox passwords are stored encrypted with AES-256-GCM. Each account has its own key, and the master key is not stored in the database.

This is not end-to-end encryption: the multiboxi server has to decrypt a password to connect to your mailbox. That is why we also protect the server itself and access to it.

Connections to mail providers are encrypted (TLS), and the website and the app work only over HTTPS.

Signing in to multiboxi

• Two-factor authentication is mandatory: a password and a code from an authenticator app.
• Backup codes in case you lose your phone.
• An email when someone signs in from a new device.
• A list of signed-in devices and one-click sign-out everywhere.
• Limits on sign-in attempts and a lockout after too many wrong codes.

What we store and what we do not

We store: your account, mailbox settings, encrypted mailbox passwords and the list of folders with message counts.

We do not store message content or attachments. multiboxi fetches a message from your provider when you open it.

In the future we will add modes that keep a copy of messages (for faster full-text search). They will stay off until you turn them on for a chosen mailbox, and then we will tell you exactly what we store.

Displaying messages

Message content is cleaned of code that could do harm and shown in an isolated frame. Images from the web are blocked until you choose to show them, so senders cannot tell this way that you opened their message.

Who can access your mail

The app has no feature that gives anyone else, including the multiboxi administrator, a view of your mailboxes.

We encrypt passwords, but the keys are on our server, so technically someone with access to the server could decrypt them. Only the service provider has access to the server. The exceptions (fixing a failure with your consent, a security breach, a legal obligation) will be described in the Terms of Service.

We do not read your mail and we do not use it for advertising, profiling or training artificial intelligence.

Where the data is

multiboxi servers run in the European Union, at OVHcloud. Database backups go to another OVHcloud data centre in the EU and are protected against deletion for 30 days. They contain no message content, because we do not store it.

If you add a mailbox with a provider outside the European Economic Area (for example DreamHost in the USA), the wizard tells you when you add it and asks for your consent.

How we check multiboxi

Before release, every version goes through automated tests, a code review by two AI agents running on different models, and a test attack carried out by an AI agent. This is not an external security audit.

Deleting your account

You can delete your account in settings. We then delete the account, settings and encrypted passwords; they disappear from backups within about 32 days. Only data we must keep stays longer, such as proof that you accepted the Terms and the security event log, without mailbox addresses or message content. Mail with your providers is not touched.

Report a security problem

If you find a security issue, write to info@multiboxi.com. We will reply and tell you what we fixed.