Patra
Start free
Menu

Security

Security that’s on from day one.

Every account gets the same protection on every plan. This page lists exactly what we do.

  • TLSEncrypted connections
  • SPFApproved senders
  • DKIMMessage signature
  • DMARCDomain policy

Encrypted in transit. Encrypted at rest.

  • Encrypted connections

    Webmail, the admin console and mail apps connect over TLS. Mail apps can only sign in once the connection is encrypted.

  • Encrypted delivery

    Mail to other providers is encrypted whenever the receiving server supports it.

  • Encrypted storage

    Stored mail, backups and our servers’ disks are encrypted at rest.

  • Passwords kept safe

    Your Patra passwords are stored only as one-way hashes. Passwords you give for an import are kept encrypted until it ends, then deleted.

Your domain stays yours.

  • Signed as you

    Mail you send carries a DKIM signature for your domain, with SPF and DMARC set up for it.

  • No one else can send as you

    Every message’s From address must belong to the sender’s own account, so another Patra customer can’t send as your domain.

  • Spoofing goes to Junk

    Incoming mail that claims to come from your domain but fails DMARC goes to Junk.

  • Alerts when DNS breaks

    If a record your mail depends on stops working, we email you and show it in the console, and tell you when it’s fixed.

Hard to break into.

Two-step sign-in for admins

  • Two-step sign-in for admins

    An authenticator app, plus backup codes that work once each.

  • Strong passwords

    Mailbox passwords need at least 12 characters, mixing three kinds of characters. Admin passwords need at least 12 characters.

  • Setup links, not shared passwords

    People choose their own password through a link that works once and expires after 7 days.

  • Automatic blocking

    Networks that keep failing to sign in are blocked automatically for a while.

Every account kept apart.

  • Separate accounts

    Your users can’t see other customers’ accounts or addresses.

  • Checked on every action

    Every action in the admin console is checked against your own account.

  • Partner actions on record

    When a partner manages a client’s account, everything they do is recorded under their name.

  • An audit log

    A record of admin actions that can’t be edited.

Protection for your good name.

  • Sending limits

    Up to 400 emails an hour per address, plus a daily total per account. Each recipient counts as one email.

  • Automatic pauses

    If bounces or spam reports climb, sending pauses before your domain’s reputation suffers.

  • A brake for stolen passwords

    A mailbox that suddenly bounces from many addresses is paused until its password is changed.

  • New accounts reviewed

    We review new accounts before they can send mail.

Backups you can count on.

  • Every 6 hours

    Backups run every 6 hours and are kept for 35 days.

  • Point-in-time recovery

    Recovery covers any moment in the last 14 days.

  • Restores tested

    We’ve tested restoring from our backups, not just making them.

  • Undo for deletes

    A deleted mailbox can be restored for 30 days.

Checked every five minutes.

  • Health checks every 5 minutes

    Mail delivery, webmail, the admin console, certificates and disk space. Our team is alerted when something is wrong.

  • Hourly checks

    Every hour we also check backups, the mail queue and our sending safeguards.

  • Blocklist checks

    Every week we check our mail server’s address against public blocklists.

  • Locked-down administration

    The mail server’s administration isn’t reachable from the internet.

Private by default.

People at Patra don’t read your mail, except in the cases our Privacy Policy describes.

Privacy Policy Subprocessors

  • No ads

    No ads in your mail, and we don’t sell personal data.

  • No AI training on your mail

    We don’t use your mail to train AI models.

  • No tracking cookies

    No tracking or analytics cookies on our website.

  • Short-lived server logs

    Our servers’ logs are generally kept for up to 30 days.

Straight answers.

Something else? Write to hello@trypatra.com.

Forgotten or changing a password

Is my mail end-to-end encrypted?

No. Mail from your apps and webmail is always encrypted on its way to us, mail from other servers whenever they support it, and everything is encrypted while it’s stored. But our servers need to read your mail to deliver it, filter spam and show it in webmail.

Do you have certifications such as SOC 2 or ISO 27001?

Not today. Instead, this page lists the measures we actually run.

Where is my data stored?

Our Subprocessors page lists each provider we use, what it does and where it processes data.

Do you guarantee uptime?

During early access we don’t offer an uptime guarantee or service credits (Terms of Service, section 2).

Can Patra staff read my mail?

Only to investigate abuse or a security incident, when you ask us to for support, or when the law requires it.

What can we do to stay safe?

Turn on two-step sign-in for admins, use strong passwords, set a recovery email for each person, and keep your DNS records in place.

Found a security problem? Write to hello@trypatra.com with “Security” in the subject. Please don’t test against other customers’ accounts.

Report it: a security problem

Bring your team to your own domain.

Free for 14 days. No payment needed to start.

Start free Talk to us