Email security and privacy

How MyPandos protects your email, described honestly — including the limits, so
you can make informed decisions.

Sign-in security

- Webmail uses single sign-on (SSO) with your MyPandos account and
requires multi-factor authentication (MFA) — a second step beyond your
password. See Multi-factor authentication.
- Mail apps use app passwords — long, random, per-device credentials you can
revoke individually without affecting anything else.
- Repeated failed logins from an address get that address temporarily blocked,
which stops password-guessing attacks automatically.

Encryption in transit

- Connections to webmail and to the mail servers are protected with TLS
(the same encryption your browser uses for banking).
- We publish SPF, DKIM, and DMARC for your domain so that others can verify
mail really came from you, which reduces spoofing and improves deliverability.

Encryption at rest

Your stored mail is encrypted on our servers at two layers by default:

- Full-disk encryption — protects data if a physical disk is ever removed,
retired, or stolen.
- Application-layer encryption of the mail files themselves.

What this does and does not mean: these layers protect your mail on stored
and backed-up media. They do not mean a MyPandos administrator can never
read your mail — running a mail service requires the servers to access message
contents (to deliver, filter spam, and power webmail search), exactly as with
Google Workspace or Microsoft 365. If you need mail that is unreadable **even to
us**, that is precisely what Private Mailbox
provides — as an explicit opt-in, with the trade-offs described there.

Spam and abuse filtering

Every message is scanned for spam and malware and checked against reputation
lists before it reaches your inbox. Newly-migrated domains may see a few
legitimate messages land in Junk at first while sending reputation builds —
mark them "not junk" and it settles quickly.

Your data is portable

You are never locked in — you can export your mail at any time. See
Exporting your email.

Questions?

If you have a specific compliance or confidentiality requirement, contact your
MyPandos administrator — we're happy to explain exactly how any of the above
applies to your situation.