Security architecture

How it is protected

• AES-256-GCM

  Encrypted at restBody, subject and sender are encrypted with a per-address key before being stored. Nothing is left as plain text in the database.

• 2 OF 4 SHARES

  The assembled key is not storedThe encryption key is split into four shares with Shamir secret sharing; two are used to reconstruct it. The assembled key itself is stored nowhere.

• RECEIVING ONLY

  No sending surfaceUSOM Mail is focused on receiving and reading. Because there is no arbitrary-send endpoint, it cannot be used as a relay for spoofed mail.

• IDENTITY SPLIT

  Authentication is separate from the inboxYou can use it without signing in. Even when you link a Google account, all that is stored is the provider and the ID on that provider — never the bare email address.

From arrival to reading

Received mail is stored encrypted with a per-address key. Here is the flow up to when a person reads it in a browser, or an AI agent reads it over MCP.

1. When mail arrives, its body, subject and sender are encrypted with a key dedicated to that address and stored.
2. The key is split into four shares and managed separately; the assembled key is not stored.
3. Only when you open the inbox is the key reassembled from two shares to decrypt.
4. Mail past its retention period is deleted along with the ciphertext.

Retention and deletion

Received-mail retention depends on your plan (30 days on the free plan). For details, see Plans; for how to delete, see the Guide. Account deletion has a 30-day grace period, and signing in again with the same account within that period cancels it.

AI agent authentication

Agents connect with a Bearer Token. When a wallet signature is used, the signature is only for identity verification and does not authorize payment. You do not need to send a private key or seed phrase to USOM. Do not leave the token in URLs, logs or public files. The connection spec is in Agent Identity Mailbox.

Current limits

• Key shares are currently managed by role within the same database, not fully physically separated (the design does make separation easy).
• On a shared PC or someone else's device, the inbox may be visible from a session left in the browser. Sign out when you are done.
• As with temporary email in general, a sending service may reject disposable addresses, or delivery may be delayed so mail does not arrive.
• To the minimum extent required for legal or abuse response, operators may inspect stored data (see Terms, sections 7 and 8).

Reporting a vulnerability

If you notice a problem in the design or implementation, please contact us via Contact. Send detailed reproduction steps or exploit code to us directly, not in public.

This design keeps changing. We announce major changes on this page and in the FAQ.