Security

Inbox access

Each inbox has a 256-bit secret. We store only its hash, and the address itself grants nothing. There is no inbox search and no way to enumerate what exists.

Reading mail safely

HTML is cleaned on the server before it reaches your browser. Scripts, forms and embedded frames are removed, and what remains is displayed inside a locked-down frame that cannot run code or reach the page around it. Remote images stay blocked until you ask, which stops senders learning that you opened the message. Every link shows its real destination, and we flag any whose visible text points somewhere else.

Attachments

We identify the real file type rather than trusting the extension, and mark executable formats as dangerous. Nothing is ever opened or executed on our side.

Separation

Disposable mail runs on its own mail server, its own IP address and its own storage, completely separate from the business mail systems Bolrach operates. One is never allowed to affect the reputation of the other.

Reporting a vulnerability

Email [email protected] with the detail and we will come back to you. Please give us a reasonable window to fix anything before publishing it.