Security
Built to be trusted with your mail.
What JULY Email does to protect your mail and your account, stated plainly. Where something is still being built, this page says so.
Mail in transit
- The mail server offers TLS to every sender and requires it before anyone signs in to send as your domain.
- It accepts mail only for domains customers have verified, and replies only when they authenticate as the address owner, so it cannot be used to relay other people's mail.
- Mail you send goes out through Amazon SES over TLS, signed with your domain's own 2048-bit DKIM key.
Mail at rest
- JULY Email is not a mailbox. A raw copy of each message is kept for up to 7 days so delivery can be retried, then deleted automatically.
- Routing records keep who wrote to which address and what happened to the message, so you can see your activity. They hold no message body.
- Google tokens, DNS provider keys and two-factor secrets are encrypted with AES-256-GCM. Each domain's DKIM signing key is held in the database on a private network; encrypting those keys at rest is in progress.
Your account
- Passwords are stored as bcrypt hashes and checked against known breaches, where only the first five characters of a hash ever leave our servers. A new password needs at least 12 characters with letters and numbers.
- Two-factor sign-in with an authenticator app and eight single-use backup codes, or a passkey that signs you in with your fingerprint, face or screen lock. Your inbox is told whenever either changes.
- After five wrong passwords for an email, sign-in pauses for that email for 15 minutes, or 2 hours if it happens again within a day. A password reset or an emailed sign-in link always lets the real owner back in.
- Settings lists every signed-in device, so you can sign one out or all of them. Changing your password signs out every other device.
- Opening billing, making send-as credentials, adding a passkey or deleting the account asks for your password again when you last entered it more than 30 minutes ago.
- Changing the sign-in email needs your password and a confirmation from both the old and the new address, and a new forwarding inbox must confirm before any mail goes there.
- Every change to your account is written to an activity log that cannot be edited afterwards.
The website
- Every page carries a strict Content Security Policy with a fresh one-time value, so a script slipped into a page does not run. HTTPS is enforced for two years, and other sites cannot frame our pages.
- Sign-up, password resets, sign-in links and the contact form are checked by Cloudflare Turnstile and a hidden field that only robots fill in. Vulnerability scanners and email harvesters are turned away before they reach the app.
- Changes are rate limited per person, and every webhook we receive is checked against its sender's signature and journaled.
Gmail and AI
- Connecting Google is optional and asks for three Gmail permissions: creating drafts, reading message headers, and managing Send mail as. JULY Email never sends mail from your Gmail.
- AI features are off until you turn them on. The messages they read are never used to train AI models.
- Disconnecting Google deletes the token from JULY Email immediately.
Where it runs
- Everything runs in the United States (AWS us-east-1): the servers, the database, the mail buffer and the sending service.
- The database is backed up every night, and each backup is read back before it counts. Backups are deleted after 14 days.
- Server logs leave out cookies and the codes in links, and keep only the most recent 50 MB for each service.
- Access to production systems is limited to the operator, over keys rather than passwords.
Found a security issue? Write to hello@julyemail.com or use the contact form with "A security report" as the topic. A person on our team replies within one business day. Please give us a fair chance to fix an issue before you share it, and don't read or change other people's data while you test. Our security.txt has the same contacts.
How data is used and kept is in the Privacy Policy.
Get started