Legal
Security
Effective date: August 24, 2026
Security is part of how Quathos Webmail is designed, not a feature bolted on afterward. This page summarizes the main technical and organizational measures we apply. No system is perfectly secure, but the platform is built to fail closed.
1. Tenant isolation
Every account’s data is isolated at the database layer using PostgreSQL Row Level Security. The application connects with a role that has no privilege to bypass those policies, and the tenant is derived from your session, never from the client. One customer cannot read or write another customer’s data.
2. Authentication and secrets
Passwords are hashed with argon2id and never stored in plain text; a mailbox password can be reset but never recovered. App passwords for devices are scoped per device and can be revoked independently. DKIM private keys used to sign your email and the credentials used during a migration are encrypted at rest, and migration credentials are destroyed at the end of each pass.
3. Data in transit and at rest
Traffic to the panel and the webmail is served over TLS, and IMAP and SMTP connections use implicit TLS on their standard ports. Mail content is processed only to store and deliver it, and sensitive material (including passwords and secrets) is never written to logs.
4. Billing integrity
Billing follows the mailboxes that exist, and every write that changes what you are charged is protected by idempotency and database transactions, so a retry never becomes a second charge. Changes to your account are recorded in a tamper-evident audit trail whose head is signed and anchored outside the database.
5. Abuse prevention
The service enforces per-account and per-mailbox rate limits and monitors for spam, phishing and account takeover, including outbound abuse from a compromised mailbox. A domain or mailbox can be suspended when abuse is detected, and mail to a suspended mailbox is refused rather than accepted and lost.
6. Payment webhooks
Events from our payment provider arrive as untrusted input. We preserve the raw payload, verify the provider’s signature, apply idempotency, and confirm that each event belongs to the right subscription and tenant before acting on it. Out-of-order and duplicate events are treated as the rule, not the exception.
7. Reporting a vulnerability
If you believe you have found a security issue, please email contact@webmail.quathos.com with the details. We appreciate responsible disclosure and will work with you to validate and address the report.