How Aerogram protects mail

Access to your space

Access is based on authentication and mandatory two-factor authentication with TOTP and backup codes. Passkeys can be saved in the settings. Each user has their own space; Connecting a mailbox does not make its mail accessible to other beta members.

Sessions can be revoked. They expire after 30 days of inactivity and at most 180 days after their creation. On a shared device, disconnect voluntarily: these delays do not replace this precaution. Keep your backup codes in a safe place and do not send them to support.

Message display

The HTML received is filtered then displayed in an isolated document, without scripts. External images are blocked by default. Allowing them for a message or mailbox may reveal your IP address and mail opening to their host. Links remain external destinations whose practices may differ from those of Aerogram.

The layout can be simplified to respect these limits. The app does not replace your vigilance for payment requests, misleading links or unexpected attachments.

Encryption, storage and backups

The application and its cache are hosted at Netcup in Germany. Personal storage enabled uses Scaleway in Paris; independent encrypted backups use Hetzner in Nuremberg. Exchanges are encrypted and data is encrypted at rest. However, the server must be able to decrypt them: this is not end-to-end encryption.

Backup checking works in-stream on the infrastructure, without a mail library on the owner's Mac. It controls the backed up data, without promising immediate restoration of a complete machine. The cache is not an archive and the Access (legacy contract) offer excludes the backup of email content. See the storage differences.

Aerogram does not sell the data, does not use it for advertising and does not integrate an AI service processing emails. There privacy policy details the purposes, conservation and your requests. Also consult the conditions of use.