TrekMail Platform Security Overview

TrekMail secures your account and email data with standard platform safeguards. Use this overview to understand the controls you can see in the product.

Security controls you manage

• Email verification: new accounts verify their email address. Sending is unavailable until the verification requirement for the account is complete. Changing your account email starts verification again.
• Two-factor authentication (TOTP) for account login.
• Role-based access through account ownership and admin permissions where available.
• Password policies and password management flows for accounts and mailboxes (including the mailbox password change portal).
• Mail app passwords: give each mail app or device a separate named password. App passwords only requires one for IMAP, SMTP, calendars and contacts; Mailbox password or app passwords accepts either. Existing mailboxes keep the latter mode at rollout. New mailboxes follow Account settings > New mailboxes > Mail apps need app passwords, on by default; changing the setting does not switch existing mailboxes. Create or revoke passwords in webmail under Settings > App passwords, or in the dashboard under the mailbox's Security tab. See Mail app passwords.
• Mailbox 2FA: protects regular webmail sign-in only. Mail apps and classic webmail never ask for a code. Regular webmail still needs the mailbox password; app passwords cannot open it or the dashboard. Classic webmail uses an app password in App passwords only mode.
• API tokens with configurable scopes, domain constraints, and expiration dates. Copy a new token when it is shown and keep it private.
• Drive device passwords (sync): use a separate, limited password for each sync app or device. Create one in Drive → Sync devices in the dashboard or webmail. Give it a name, choose its permissions, and set an optional expiry. Account admins can create account-wide passwords; mailbox users can create mailbox-only passwords from webmail. Revoking one password leaves other devices connected. A new password is shown only when you create it. Account admins can see and revoke devices from both surfaces. See Sync devices for the full lifecycle.
• API audit log helps account admins review API activity and investigate unexpected changes.

Admin mailbox-password resets and password recovery revoke all app passwords. A user changing their own password in webmail can select Also revoke all app passwords (off by default). Sign-in suspension, conversion to shared, and moving to Recently deleted also revoke them; restoration does not bring them back. Shared mailboxes have no app passwords of their own: members use their own mailbox credentials.

Data encryption

• Protected secrets: sensitive credentials that TrekMail must recover for an operation, such as certain provider tokens or migration credentials, are stored using application encryption. Passwords used only for authentication are stored as one-way hashes.
• Security maintenance: TrekMail maintains the protections used for stored data without requiring you to reconfigure your account.
• Compliance records: limited billing and administrative records can be retained when an account is deleted. See Privacy and Data Retention for the applicable policy.
• Password protection: passwords are protected and are not displayed again after you create or change them. Use the available password-change or reset flow if you need a new one.

Operational practices

• TLS is required for the IMAP and SMTP connection paths shown under Apps & devices. Use the exact host, port, and TLS method shown for the mailbox or brand rather than copying values from an old guide.
• DNS authentication (SPF, DKIM, DMARC) is required for sending to protect your domain identity.
• Disposable and throwaway email addresses are blocked at registration to prevent abuse.
• Inbound email is checked by several spam and safety controls, including protections for dangerous attachments.
• Rate limits and abuse controls protect public sign-in and mail services.
• Browser security controls help protect the dashboard and webmail.
• Disabled and suspended mailboxes are excluded from mail delivery. TrekMail does not accept or route mail for a non-active mailbox.
• Outbound mail is watched per mailbox. If what leaves one mailbox suggests a stolen password, TrekMail can stop that mailbox from sending without interrupting other mailboxes on the account. Change the password and contact support to review restoration of sending. See Mailbox Security.
• Vulnerable dependencies are blocked at deploy time via automated audit checks.

Independent researchers can review our Security & Vulnerability Disclosure Policy before testing or reporting an issue. Researchers whose valid reports help protect TrekMail may be recognized in our Security Hall of Fame.

API and MCP security

• API tokens use bearer authentication over HTTPS. Keep a token private and revoke it if you suspect that it has been exposed.
• Scopes limit what each token can do. Domain constraints limit which domains it can access.
• Mailbox deletion requires a two-step intent-and-confirm flow with a 10-minute expiration.
• The MCP server disables destructive operations by default. Delete tools require explicit opt-in.
• Connection settings and migration requests are validated before use.
• Account admins can review API activity under AI Agents & API → Audit Log.
• Request limits help protect mailbox data from automated collection.

Quick fixes and troubleshooting

• Enable 2FA for all admins to reduce account takeover risk.
• Keep DNS records current to prevent spoofing and deliverability issues.
• Revoke API tokens immediately if you suspect they have been compromised.
• Review the API audit log regularly to detect unexpected activity.
• Report suspicious activity via the Support Center with timestamps and affected accounts.