Security

Updated 4 October 2026.

Commonside uses encrypted connections, password protection and checks against unauthorized sending. These reduce risk, but they do not make ordinary email end-to-end encrypted.

What mailbox encryption does

Stored message files are encrypted with server-held keys. This protects those files when someone has the files but not the keys. Privileged operators with the keys can technically read messages.

For upgraded mailboxes your password unlocks a personal mailbox encryption key, and no staff recovery key exists: losing both the password and the mailbox secret loses old-mail access. Older mailboxes still rely on server-held keys. Your recovery code restores account access; for upgraded mailboxes the mailbox secret is separate.

This protection does not cover every index, database, log or backup. If you need message contents hidden from mail providers, use end-to-end encryption such as OpenPGP with a compatible client and recipient. Addressing and delivery metadata can still be visible.

Secure connections

Use our HTTPS websites and keep certificate verification enabled in mail apps. Mail verifies certificates for its mail connections. Mail-client setup is listed in Documentation.

We publish an MTA-STS policy to help supporting senders use verified TLS for incoming mail. This does not guarantee encrypted delivery on every internet hop or hide content from the servers handling it.

Protecting your account

Choose a unique password and save your recovery code separately. Account passwords are stored as hashes, not as readable passwords. Protected password changes require your confirmed recovery code; rotating it requires the previous code. Lost-password recovery consumes the code, so save and confirm a replacement afterward.

Sessions expire, sensitive forms have security checks, and sensitive routes have rate limits. Staff logins additionally require two-factor authentication. Ordinary IMAP and SMTP logins use your account password.

Sign out other devices revokes other panel sessions. Webmail and mail-app sessions are separate; this button does not promise to disconnect every mail client. Never send your password, recovery code or private keys to staff.

Aliases and protection against impersonation

You can send using your primary address or an alias you own. The mail server checks sender and reply-address ownership, not just what webmail displays. Attempts to use another user's or an external address are rejected. Removing an alias revokes its sending permission immediately.

SPF, DKIM and DMARC help other providers identify legitimate Commonside mail. Our DMARC policy requests quarantine for failures, but receiving providers decide how to apply it. These checks do not guarantee inbox delivery or prevent all external spoofing. Spam filtering also cannot catch every unwanted message.

Staff access and records

Staff permissions restrict application review and service-mailbox access, and sensitive actions are audited. Services are separated with restricted access, but this is not a guarantee that privileged operators cannot access user data.

Web and mail systems keep operational and security records, including some raw IP addresses and delivery metadata. Read Privacy for what is processed and retained.

Deletion and keeping your mail safe

Account closure permanently removes live account and mailbox data through a queued cleanup process. Accounts inactive for 12 calendar months are also subject to deletion after advance warnings. Logging in before inactivity cleanup starts cancels it. Backups, audit records and recipients' copies can remain; deletion is not a zero-trace guarantee.

Keep your own copies of important mail. Database restore tests have passed, but complete off-host mailbox-and-key backup and full disaster recovery have not been demonstrated. We cannot guarantee uninterrupted service or claim a completed independent security audit.

Report a concern

Email support@commonside.org with a security-report subject and a minimal description. Describe sensitive evidence first so volunteers can arrange safe handling. Do not publish private data, send account secrets or disrupt service.

Report spam, harassment and other abuse to abuse@commonside.org.