Security
Audited quarterly. Open source.
The cryptographic core is published under a permissive license. Independent firms audit the handshake, storage and key-rotation flows every quarter. Reports are public, redacted only for customer identifiers.
SOC 2 Type II
GDPR
ISO 27001
HIPAA ready
End-to-end encryption
OpenPGP on by default. Mail between LatinaMail accounts is encrypted on your device and only decrypted on another device you own.
Zero-knowledge storage
Inbox, calendar and contacts live encrypted at rest. Our engineers cannot read your mail — that’s a property of the system, not a promise.
Edge protections
Cloudflare Tunnel in front, Turnstile on every state-changing request, HMAC-signed sessions, strict per-IP and per-ASN rate limits.
Warrant canary
Signed every month since 2019. Read the current version on the canary page.
security.yml
verified
- encryption
- aes-256-gcm
- protocol
- openpgp + mls
- transport
- tls 1.3 strict
- key_length
- 4096-bit rsa
- audits
- cure53, isec
- uptime_90d
- 99.99%
- open_source
- core + all clients