Security
Where Mailmoni runs, what we encrypt, who can reach your data, and how to report a vulnerability.
- Server
- At Hetzner in Helsinki, Finland
- Backups
- Encrypted every night and stored in the EU
- Two-step sign-in
- On every plan
- Report a vulnerability
- support@mailmoni.com
Where it runs
Mailmoni runs on a server at Hetzner in Helsinki, Finland. Your account, your domains and your reports are stored there.
The privacy policy names every company that handles data for us, what each one does and where it is based.
Encryption
Every page is served over HTTPS. Our mail server accepts reports over an encrypted connection whenever the sending server supports it.
We encrypt the keys and secrets you give us, such as a DNS provider's API token, before we store them.
Backups
We back up your data every night. We encrypt each backup before it leaves our server and store it in the EU. We check the backups regularly.
Who can reach your data
No other customer can see your organization's domains and reports. Your admins choose the members, and can see and turn off every link, token and connection that reaches your data from outside Mailmoni.
We use your data only to provide the service to you, as the terms of service say. We do not sell it, and we do not use it for advertising.
Mailmoni uses no analytics and no advertising trackers. The public pages set no cookie and run no script.
Signing in
Two-step sign-in with an authenticator app, a passkey or a security key is available on every plan. We store passwords only as a hash, and we limit repeated sign-in attempts.
How reports are handled
Anyone can send mail to a reporting address, so we treat every report as untrusted and read it under strict limits.
A forensic report can contain email addresses. By default we remove the part of each address before the @, the subject and the body, and delete the original message.
How long we keep data
How long reports are kept depends on the plan:
- Starter: 30 days
- Pro: 13 months
- Teams: 25 months
- Enterprise: 37 months
When you delete your organization, access ends at once, and we purge its data 30 days later.
The privacy policy lists everything else we keep, and for how long.
Report a vulnerability
If you find a security problem in Mailmoni, write to support@mailmoni.com.
Describe what you found, the address or part of the product it affects, and the steps that show it.
We reply by email. Give us time to fix the problem before you publish it.
A question this page does not answer
Ask us through the support page. We answer in English or Finnish.