Security overview

What runs on your device, and what runs on the relay

Zip Mail is a mail client first. Almost everything happens on your iPhone, iPad, Mac or Apple Watch. The relay is an optional service that exists for one reason: iOS doesn’t let apps keep a mail connection open in the background, so something else has to watch your inbox if you want mail within seconds.

Instant delivery is turned on per mail account, after a consent screen that explains what the relay stores. You can turn it off for any account at any time, and deleting your Zip Mail account removes the relay’s access to all of them.

What the relay stores, and what it never stores

Send Later is the one case where the relay stores a message body, and we want to be clear about it. It only happens when your mail provider can’t hold a scheduled message itself and no Mac of yours is awake to send it. The message is encrypted on its own, sent from your own account through your provider at the scheduled time, and deleted.

Credential vault

To watch an inbox, the relay needs a way to sign in to it: an OAuth token for Gmail or Microsoft, or an app password for IMAP providers such as iCloud, Fastmail or Yahoo. These are the most sensitive things we hold, so they get the strongest protection.

• Per-credential keys. Every credential is encrypted with its own data key. That data key is itself encrypted by a key in Google Cloud Key Management Service (KMS), held in hardware security modules.
• Bound to your account. Each decryption request carries your account ID as encryption context. A credential can’t be decrypted in the context of a different account.
• Key custody separated from compute. The keys live with a different cloud provider from the servers that run the relay. A copy of our database or a compromised server alone isn’t enough to read credentials.
• Only the watcher can decrypt. The one service that watches mailboxes is the only one allowed to ask KMS to decrypt. Any other decrypt attempt raises an alert.
• Nothing left behind. Watcher processes run with no core dumps, no swap and no mail protocol logging, so decrypted credentials and mail traffic don’t end up on disk.

Least-privilege access to your mail

• Its own grant. For Gmail and Microsoft, the relay goes through its own sign-in consent and gets its own token. The tokens on your devices are never sent to the relay.
• Narrow scopes, added only when needed. The relay first asks only for the access it needs to notice new mail. Permission to send is requested separately, and only when you first use a feature that needs it, such as a Send Later message the relay has to deliver.
• Revoked on deletion. Deleting your Zip Mail account revokes the relay’s grants with Google and Microsoft and wipes its stored credentials.
• Platform rules. Our use of Gmail data will follow the Google API Services User Data Policy, including its Limited Use requirements, and we will complete Google’s required security assessment before Google sign-in launches.

Push encryption and its limits

Every notification is encrypted by the relay to a key that belongs to your device (using HPKE), before it’s handed to Apple Push Notification service (APNs). The key never leaves your device’s keychain. Zip Mail’s notification extension decrypts it on your device, even while it’s locked.

Your Zip Mail account: passkeys, no passwords

• Passkeys first. You sign in with a passkey stored in iCloud Keychain or a password manager such as 1Password, confirmed with Face ID or Touch ID. Sign in with Apple and a one-time email code are available as fallbacks. There is never a Zip Mail password to guess, reuse or phish.
• Device checks. New devices are verified with Apple’s App Attest. You can see and revoke your devices, and your other devices are notified when a new one is added.
• End-to-end encrypted settings. Sensitive synced items, such as snippets, signatures, credentials synced between your devices, your writing style and sender tables, are encrypted with an account key that only your devices hold. That key is protected by your passkey and kept in iCloud Keychain, with an optional recovery key. The relay can read only the settings it needs to act on, like your notification rules.
• Local-first. You don’t need a Zip Mail account to read mail. It’s only needed for instant delivery and syncing settings.

Safe message display

Email is written by strangers, so Zip Mail treats every message as untrusted.

• No JavaScript in email. Scripts are turned off in the message viewer.
• No direct network access. The viewer is blocked from loading anything from the internet by itself. Images are handed to it by the app after tracker filtering, and a strict content security policy is added to every message.
• Sanitized with a real HTML parser, in a private, non-persistent web view that is cleared between messages.
• Links never open silently. Tapping a link shows the real destination first, with a warning if the link text points somewhere else.
• Remote content policy. In the default Automatic mode, images load after tracking pixels, known tracker hosts and link-tracking redirects are removed. Senders you trust load directly; other senders load through our image proxy for Pro users, so they don’t see your IP address. You can choose Trusted Senders Only or Block All Remote Content instead. Mail with suspicious signals, such as failed sender authentication, lookalike domains or display-name spoofing, always has remote content blocked, in every mode, until you choose to show it.
• Image proxy isolation. The image proxy runs on Cloudflare Workers, which can’t reach our private network, so it can’t be turned against our own infrastructure.

Infrastructure and Canadian hosting

• Hosted in Canada (Toronto). Relay servers and the database run on DigitalOcean in Toronto. Encryption keys are held in Google Cloud KMS in Toronto.
• No open ports. Relay servers accept no inbound connections from the internet. Traffic reaches them only through an outbound Cloudflare Tunnel, behind Cloudflare’s DDoS protection and web application firewall.
• Hardened containers. Services run as non-root users in read-only, minimal container images. Images are signed and verified at deploy time. Traffic between servers uses mutual TLS.
• Encrypted backups with point-in-time recovery, and audit logs written to storage that can’t be altered.
• US-based subprocessors are also used. Apple APNs delivers encrypted notifications. Gmail change notifications come through Google Cloud Pub/Sub, with message storage restricted to Toronto. Anthropic processes cloud AI requests in the United States only if cloud AI extras are enabled. Cloudflare continues to operate its global network. See the privacy policy for details.

Who can access production

• No standing access. Nobody at Zip Mail, including engineers, has everyday access to production systems or data.
• Break-glass only. Emergency access needs two people, is limited in time, requires single sign-on with hardware security keys, and every session is recorded.
• Alerts and audit. Break-glass sessions and any credential decryption outside the watcher service raise alerts. Audit logs are kept for one year.
• Deploys are automated. Changes reach production through an automated pipeline, not by people logging in to servers.

Reviews and testing

The relay will have a dedicated security review before it opens to beta testers and an independent penetration test before public launch. Gmail support will go through Google’s Cloud Application Security Assessment (CASA), renewed yearly. We’ll list completed assessments here rather than claim them in advance.

Reporting a vulnerability

If you think you’ve found a security issue in Zip Mail, the relay or this website, please email support@zipmail.app. Our security.txt lists the same contact.

• Include enough detail for us to reproduce the issue, and let us know how to reach you.
• Please give us reasonable time to fix the issue before sharing it publicly.
• Only test against accounts you own. Don’t access other people’s data, degrade the service, or use social engineering or phishing.

We’ll acknowledge your report, keep you updated while we work on it, and credit you if you’d like.