Security
Last updated:
Mailfolk keeps your email on your computer and treats every message as content that can't be trusted. Here we explain how we protect your data, the app and its updates.
Your data
Email stays local
Messages, attachments and the search index live in a database on your computer, in a folder only your user account can access. They never go through our servers.
Passwords in the keychain
Mailbox passwords are stored in the system keychain: Keychain on macOS, Credential Manager on Windows, Secret Service on Linux. They never end up in the database, in logs or in configuration files.
Encrypted connections
IMAP uses TLS with certificate and server name verification. SMTP uses TLS on port 465 and mandatory STARTTLS on port 587.
The email you receive
No browser inside your email
HTML messages are drawn by an engine written specifically for Mailfolk, with no embedded browser and no JavaScript. Images and SVGs are converted with size and memory limits, and they can't read files from your computer.
Remote images and icons
Remote images and sender icons are only downloaded if you allow it; without your consent Mailfolk only downloads the icons of your own domains and of those you've already written to. That way senders can't tell when you open a message.
AI and assistants
On-device AI
Summaries use a model that runs on your computer. You download it only if you want to, and we verify its SHA-256 fingerprint before it's used.
Assistant access
The MCP server for Claude, ChatGPT and other assistants stays off until you turn it on, for as long as you choose. No tool can send email: assistants prepare drafts that you review and send yourself. Every request, including rejected ones, is logged before it runs.
App and updates
Code signing
On macOS the app is signed with an Apple Developer ID certificate and notarized by Apple. The Windows installer is not signed with Authenticode, so Windows may show a warning the first time you run it.
Signed updates
Every update is signed with our own Ed25519 key. Before installing it, the app checks the signature and the package's SHA-256 fingerprint; on macOS it also checks the code signature. If anything doesn't match, the update is discarded.
Development
Mailfolk is written in Rust. Dependencies are pinned to exact versions and every change goes through automated tests. The code undergoes regular security reviews; the most recent was in October 2026.
Infrastructure
Servers
The website, licenses and updates run on an Aruba VPS in the IT3 data center in Ponte San Pietro (Bergamo), Italy, reachable only over HTTPS. Licenses are verified with Ed25519-signed tokens.
Reporting a problem
Found a vulnerability?
Email us at hello@mailfolk.email with the details and, if you can, the steps to reproduce it. We'll reply as soon as possible and keep you updated on the fix. Please don't make it public until it's resolved.