How AppWT Mail handles your mailbox

Plain answers about what this interface does with your mailbox and your password. Everything below is how the software is built, not a policy statement.

Every connection is encrypted and verified

Mail is fetched over IMAP on port 993 with TLS, and filters are read over ManageSieve on port 4190 with STARTTLS. Both connections verify the server certificate in full. Self-signed and mismatched certificates are refused rather than accepted with a warning, so an intercepted connection fails instead of quietly working.

Your password

Your mailbox password is needed for every request, because this interface holds no mail of its own: it asks your mailbox each time. It is kept only for the length of your sign-in session, sealed with AES-256-GCM under a key stored outside the web directory. A copy of a session file on its own does not reveal a password. Nothing writes your password to a log, a report or a file.

Sessions

The session cookie is marked Secure, HttpOnly and SameSite=Strict, so it is only ever sent over HTTPS, no script can read it, and it is not sent from another site. Session files live outside the web directory and cannot be requested through the browser.

This build is read-only

Mailboxes are opened with the IMAP EXAMINE command and headers are fetched with BODY.PEEK. Both are read-only by design: viewing a folder here does not mark anything as read, and this build has no path that can delete, move or expunge a message. That restriction comes off only when the owner says so, and message reading and compose arrive with it.

Only mailboxes we host

Sign-in is limited to the mail domains we run. An address on any other domain is refused before a connection is attempted, so this interface cannot be aimed at an account that is not ours.

Filters are read from one place

Filter rules are read from, and written back to, the mail server's own filter script. There is no second copy. Two rule stores are how a mailbox ends up filing mail by a rule the screen does not show.

Reporting something

If something here looks wrong, tell us rather than working around it. Call (888) 565-0171 or email sales@appwt.com.