Security

How we keep your mail and your account safe, and how to tell us when something isn't.

Your account

• Two-step sign-in. Turn it on under Account so a password alone isn't enough to get in.
• Sign-in cookies scripts can't read. Your session is kept in secure, HTTP-only cookies, so a script on a page can't take it.
• Nobody here can get in for you. Our staff have no tool to read your mail or to reset your password. A forgotten password is reset only by you, with a code sent to your recovery e-mail.
• Bots kept out. Sign-up runs a check in your browser and limits how many accounts one network can make.

Your mail

• Encrypted on the way. The site only works over HTTPS, and mail travels between servers over TLS whenever the other side supports it.
• Every sender checked. Each arriving mail is checked with SPF, DKIM and DMARC.
• Phishing warnings. Forged senders, look-alike brands and links that lead somewhere else than they say get a warning in plain words.
• No tracking. Known tracking pictures are removed, and pictures load through our servers so senders don't see your IP address.
• Stored in the EU. Your mail is kept in Helsinki, Finland.

Reviews

Before sign-up opens to everyone, the mail service gets a full security review. We'll summarise what was found and fixed on this page.

Report a problem

Found a weakness? E-mail security@helloagain.gg with what you found and how to see it. Please give us time to fix it before telling others, and don't access other people's mail while testing. We'll answer and keep you posted.

Received a phishing mail that pretends to be HelloAgain? We only ever write from helloagain.gg addresses, and we never ask for your password by e-mail.