Security

When you connect your Google account to MailPorter, we request a specific set of permissions from Google. We ask for the ability to insert emails and manage labels - that's it. We don't request permission to read your existing emails, search your inbox, or delete anything.

You can verify these permissions yourself in your Google Account settings. Go to "Security" → "Third-party apps with account access" → find MailPorter, and you'll see exactly what access we have.

Your mail server password is encrypted using AES-256 encryption before we store it. The encryption key is stored separately from the database, so even if someone gained access to our database, they wouldn't be able to decrypt your password.

For Gmail authentication, we use OAuth 2.0. This is an industry-standard protocol where Google handles the login process directly. We never see your Google password - we only receive a limited-access token that Google provides.

When MailPorter imports an email, it reads the message from your mail server and immediately sends it to Gmail through the API. We don't store copies of your emails on our servers. The email passes through our system, but it doesn't stay there.

We do store metadata about sync jobs (like when the last sync happened and how many emails were imported) to provide the dashboard experience and troubleshooting logs. But we don't store the content of your emails.

All connections to mail servers use SSL/TLS encryption (or STARTTLS where appropriate). The connection to Gmail's API is also encrypted. And of course, the connection between your browser and MailPorter uses HTTPS. Your data is encrypted in transit at every step.

GDPR compliant, built in Europe

MailPorter is built and hosted in Europe. Your data is processed in full compliance with the General Data Protection Regulation (GDPR). We don't store email content on our servers, and we only collect the minimum data necessary to provide the service.

You can request a full export or deletion of your data at any time. When you delete a sync job, your mail server credentials are permanently removed from our system.

MailPorter has been independently security tested by TAC Security under the Cloud Application Security Assessment (CASA) Tier 2 requirements. CASA is a security framework used to verify that applications accessing Google user data meet rigorous security standards.

The assessment covers areas including authentication, data handling, network security, and vulnerability management, ensuring MailPorter meets the security bar required for applications with access to Google user data.

You can disconnect MailPorter from your Google account at any time. Go to your Google Account settings, find "Third-party apps with account access," locate MailPorter, and remove its access. Your sync jobs will stop immediately.

You can also delete your sync jobs from your MailPorter dashboard, which will remove your stored mail server credentials from our system.