Security and trust
Ayamail is built privacy-first: encryption, European hosting and transparency about how we protect your data.
Encryption
Zero-access encryption
Drive, Pass, Calendar and Contacts are encrypted in your browser with AES-GCM before data leaves the device. We cannot read your content.
Encryption in transit
All traffic runs over TLS 1.2+. For mail we support MTA-STS and TLS reporting so transport cannot be downgraded.
Encryption at rest
Data is stored encrypted on European servers at Hetzner (Germany/Finland) with access control and continuous backup.
Zero-access - explained without marketing speak
Drive, Pass, Docs, Sheets, Contacts and Calendar are encrypted in your browser before anything is sent.
1 · Your device encrypts
Web Crypto derives a key from your password with PBKDF2 and encrypts the content with AES-GCM.
2 · The server only sees ciphertext
We store the encrypted blob. We cannot read it, index it or hand over the content.
3 · Only you hold the key
The key never leaves your device. Lose it and we cannot restore the content - that is the point.
An honest caveat: ordinary email to and from other providers cannot be zero-access. There we use TLS in transit and OpenPGP when the recipient supports it.
AES-GCM + PBKDF2
Standard Web Crypto in the browser - no home-made cryptography.
EU hosting
Data lives on servers in the EU and is processed under GDPR.
No tracking
No ad pixels, no profile building, no data selling.
You can always leave
Export mail, calendar and contacts in open formats - and delete your account.
Mail security
- SPF, DKIM and DMARC on all domains - with guide and live checks in Aya Domains.
- DMARC reporting and ARC sealing protect against spoofing and phishing.
- Two-factor authentication (TOTP) and an active-sessions overview in account settings.
Open standards
No lock-in: use Ayamail with the clients you already know.
- IMAP for your inbox in Apple Mail, Thunderbird and Outlook.
- SMTP with modern authentication for sending.
- CalDAV for calendars on every device.
- CardDAV for contacts - synced and encrypted.
GDPR and your rights
We are a data processor under European law - and you can always take your data with you.
- Data processing agreement (DPA) for all Business customers.
- Full export of mail, calendar and contacts in open formats.
- Account and data deletion within 30 days.
Transparency
Public status page with uptime and incidents.
European data handling under GDPR - you own your data.
No ads, no tracking, no selling of data. We live off subscriptions.
Report a vulnerability
Found a security issue? Write to us - we respond quickly and treat all reports confidentially.
security@ayamail.netTake your inbox back
Create a free account in a minute - or pick your own domain right away.
Free forever on @ayamail.net · No card required