BlueMail security: how your mail is actually protected

Every email client claims to be secure. The claim is worth exactly as much as the detail behind it, so here is the detail.

Sign-in without passwords

BlueMail uses OAuth 2.0 with every major provider. You authenticate on the provider’s own login page, in their own domain, and the app receives a scoped token instead of a password.

Three things follow from that:

1. Your password never reaches BlueMail. Not in transit, not at rest, not in a log
2. Multi-factor authentication works normally, because you are signing in with the provider directly
3. You can revoke access yourself from your Google, Microsoft or Apple account settings, without asking anyone

This is also why the industry moved. Microsoft retired basic authentication for Exchange Online, and Google removed less secure app access. Clients that still want a raw password are working around that, and working around it is the problem.

In transit

Connections use TLS 1.2 and above with certificate validation and no silent downgrade. If a server offers something weaker, the connection fails rather than quietly continuing over a channel you were not told about. STARTTLS is supported where a provider requires it.

Push notifications travel through a relay that is deliberately message-blind. It knows a device should wake up. It does not carry your mail.

End-to-end, when you want it

Transport encryption protects the hop. End-to-end encryption protects the message, including from every server along the way.

BlueMail supports both common standards. You can bring your own key or create one in the app, and the private key stays on your device. BlueMail does not hold it, which also means it cannot be recovered for you, which is the correct trade and worth understanding before you rely on it.

Signatures are verified and shown, so you can tell a message that was actually signed by the sender from one that merely claims to be from them.

What is on BlueMail’s servers

Nothing.

BlueMail syncs directly between your device and your provider. There is no intermediate mailbox, no server-side copy, and no archive of your mail on BlueMail’s infrastructure. That is not a policy that could change quietly, it is the shape of the architecture.

It also means there is nothing there to sell, and nothing worth stealing for anyone who attacks the company.

On the device

• Lock screen. Passcode or biometric protection on every platform
• Tracker blocking. Remote pixels are blocked by default, so a sender learns nothing about when or whether you opened a message
• Attachment safety. Dangerous file types are blocked, risky archives raise a warning, and misleading filenames are flagged
• Metadata stripping. Location data is removed from photos you attach unless you deliberately keep it

Compliance

BlueMail operates under GDPR and CCPA, including the rights of access, deletion and portability. The official privacy policy sets out what is collected and why.

The part nobody advertises

No client can protect you from a compromised account. If someone has your provider credentials and your second factor, they have your mail regardless of which app you read it in.

Turn on multi-factor authentication, prefer a passkey or an authenticator app over SMS, and review the list of connected applications on your provider account occasionally. That single hour of work protects you more than any feature on this page.