Your email is personal, so we built Mailzo to keep it in your hands, not ours.
Security
Last updated: November 2026
How Mailzo protects you
- Your mail stays on your Mac, in an encrypted database. It's never sent to our servers.
- Passwords live in the Mac Keychain, not in the app's database.
- Your synced vault is end-to-end encrypted. It's locked with a key only your devices hold. New devices are linked only after you confirm a matching number on a device you already use.
- Team data is encrypted with a team key our servers never see.
- Touch ID lock, so nobody can open Mailzo on your Mac without you.
- Encrypted email (OpenPGP), compatible with Thunderbird, Proton and GPG.
- Tracker blocking: hidden tracking pictures are blocked, and tracking codes are removed from links.
- Signed updates: every update is signed by us and checked by the app, so it refuses files from anyone else.
- Open source: anyone can read the code and check these claims.
Reporting a security problem
If you think you've found a security problem in Mailzo, please tell us privately so we can fix it before anyone can misuse it.
- Best: use Report a vulnerability on the Security tab of Mailzo's GitHub repository.
- Or email: hello@getmailzo.com
Please include:
- What you found
- How to reproduce it
- What someone could do with it
Please don't post it publicly, open a public issue, or access, change or delete anyone else's data while testing. Only test with your own accounts.
What we promise in return
- We'll reply within [3 working days].
- We'll keep you updated while we fix it.
- We won't take legal action against you for research done in good faith under these rules.
- With your permission, we'll thank you publicly once it's fixed.