Features / Security and privacy

Your email is your business. We treat it that way.

How Qasid protects your account, your mailbox and your data.

Why it matters

Email holds contracts, invoices, passwords and conversations with your clients. Here is plainly what Qasid does to keep it safe, and what stays under your control.

What you get

• Your mailbox stays on your server. Your email lives on your own mail server. To make the inbox and search fast, Qasid keeps a copy of your recent messages (sender, subject and preview, plus the text of emails opened in the last 30 days, never attachments) and deletes it when you remove the mailbox.
• Confidential mode. Send a secure link instead of the email, with an expiry date and an optional passcode, and withdraw it any time. The content is encrypted with a key that only the link holds.
• Encrypted mailbox passwords. Mailbox passwords and cPanel tokens are encrypted (AES-256) and only used to talk to your own server.
• Strong sign-in. Account passwords are stored with Argon2id. Two-step sign-in with an authenticator app and recovery codes, with lockout after repeated wrong codes.
• Sessions you control. See every device signed in to your account and sign any of them out.
• Locked-down mail viewer. Emails open in an isolated frame where scripts can’t run, so a malicious email can’t act inside your account.
• Support only with a reason. Every time our support team views your account (read-only), you see it in Settings, with the reason.
• Audit log. Admins see sign-ins, shares, setting changes and deletions across the organization.
• Your data, your choice. Download everything we hold about you as a file, or delete your account, at any time.
• Encrypted, off-site backups. Our database is backed up daily, encrypted, and copied to a separate location.
• HTTPS everywhere. Every connection is encrypted, including custom domains for resellers.

Questions

Who can read my email?

You, and teammates you’ve shared a mailbox with. Support can only view an account read-only, and you’re shown every time it happens.

What happens when I delete my account?

Deletion is scheduled with a 7-day grace period in case it was a mistake, then your account data is removed. The mail on your own server is never touched.

Is open tracking private?

Tracking is only used on emails you choose, and visits are counted without keeping recipients’ IP addresses in readable form.