Security design
- Mail is encrypted on the sender’s device separately for each recipient device before relay.
- Readable messages, contacts, drafts, mailbox history, and private messaging keys remain in the encrypted local vault.
- Passkeys provide passwordless authentication; private passkey material remains with the user’s authenticator.
- Relay connections use transport encryption, server access is restricted, and server backups are encrypted with an offline decryption key.
- Optional G1 mailbox backups are encrypted on the user’s device with a separate passphrase before upload. G1 stores ciphertext and cannot recover a forgotten passphrase.
- Optional notifications contain a generic signal rather than a message subject or body.
Know the limits
No service can promise absolute security. A compromised or unlocked device can expose locally readable information. Recipients can copy or disclose mail after decrypting it. Metadata needed to authenticate users and route encrypted packages is visible to the service. Safety reports deliberately disclose the selected message text for review.
Report a vulnerability
Email [email protected] with “Plexus Mail security report” in the subject. Include the affected URL or component, impact, reproducible steps, and any proof that does not expose another person’s data. We will acknowledge a credible report as soon as practical and provide updates while it is investigated.
Good-faith research rules
Research that follows these rules will be treated as authorized good-faith activity, and we will not pursue legal action solely for that compliant research. This is not a bug-bounty program and we cannot promise payment.
- Use only accounts and data you own or have explicit permission to test.
- Do not access, retain, alter, or disclose another user’s information.
- Do not use denial-of-service, spam, social engineering, physical attacks, malware, or automated testing that degrades the service.
- Stop and report immediately if you encounter personal data, secrets, or an active compromise.
- Give us reasonable time to investigate and fix an issue before public disclosure.
In scope
The Plexus Mail web application, public website, first-party APIs, authentication flow, encrypted relay behavior, and official Microsoft Store package are in scope. Third-party services, user devices, and unrelated Unsync services are outside scope; report third-party issues to their respective operators.
Supported versions
Security fixes are delivered through the hosted web application and current Store package. Only the latest publicly available version is supported.