TrainmailProtection with explicit boundaries.
Security is more credible when the service explains both its controls and its limits. This page describes Trainmail's current public security posture, not a certification or independent audit.
Security model
Trainmail is a hosted email provider. It authenticates users, stores and processes mail on servers, and exposes a web client plus approved protocol and API access. The service is responsible for reducing unauthorized account access, cross-account data access, malicious email rendering, spoofing, abuse, and infrastructure failure.
Current controls
- TLS for the web interface and supported IMAP/SMTP connections.
- Two-factor authentication, active-session visibility, and session revocation.
- Login and registration abuse controls, rate limits, and administrative monitoring.
- Sandboxing and sanitization for HTML email rendering to reduce script execution.
- External-image blocking in the mailbox client to reduce tracking requests.
- Scoped API keys, per-key rate limits, audit metadata, revocation, and controlled mailbox provisioning.
- Authorization checks intended to bind mailbox objects and API resources to the authenticated account or key.
Email authenticity and spoofing
Trainmail publishes SPF, DKIM, and DMARC records for its domain and enforces authenticated sender alignment for outgoing mail submitted through its infrastructure. These controls make unauthorized use of @trainmail.online addresses harder, but they cannot stop look-alike domains, compromised legitimate accounts, or every forwarded-message edge case.
What Trainmail does not claim
- Mailbox content is not currently end-to-end encrypted by Trainmail.
- No public independent penetration-test or security certification is claimed on this page.
- Spam and phishing detection cannot guarantee that every harmful message is blocked.
- IP-based location and risk signals are approximate and can be affected by VPNs or carrier networks.
For message-level secrecy from providers, encrypt content before sending with a tool whose keys remain under the communicating users' control.
Report a vulnerability responsibly
Email support@trainmail.online with “Security report” in the subject. Include affected URL or component, clear reproduction steps, impact, and minimal proof. Use only accounts and data you own or have explicit permission to test.
Do not access other users' messages, retain personal data, run denial-of-service tests, send bulk spam, destroy data, or publicly disclose an unresolved issue. If accidental access occurs, stop immediately and report only what is necessary.
Trainmail will review credible reports and may ask for additional detail. This page does not currently promise a bounty or a fixed response time.