Security

Last updated: March 2026

Our Security Principles

Security isn't a feature we added — it's the foundation we built on. Every architectural decision in Unleashed Mail starts with the question: "How do we protect the user's data?"

Local-First Architecture

Your emails are stored and processed entirely on your Mac. We operate no cloud servers that store email content. This eliminates the most common attack vector: server-side data breaches.

Encryption

  • Database: All email data is encrypted at rest using AES-256 via SQLCipher with PBKDF2 key derivation (256,000 iterations).
  • Keychain: OAuth tokens, API keys, and the database encryption key are stored in the macOS Keychain with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly — they are never synced to iCloud Keychain.
  • Transport: All network communication uses TLS 1.2 or later. Certificate pinning is applied to email provider API connections.
  • Key immutability: The database encryption key is generated once and stored as an immutable value. It is never re-derived or regenerated.

Authentication

  • OAuth 2.0 with PKCE: Industry-standard Proof Key for Code Exchange prevents authorization code interception attacks.
  • No password storage: Your email passwords are never entered into or stored by Unleashed Mail. Authentication is handled entirely through your email provider's OAuth consent flow.
  • Automatic token refresh: OAuth tokens are automatically refreshed when they expire, with secure retry-once-on-401 patterns.
  • Biometric protection: Optional Touch ID authentication can protect access to the app and your stored credentials via the macOS Secure Enclave.

Multi-Account Isolation

When you connect multiple email accounts, strict data isolation is enforced at the database layer. Every query filters by account_email to prevent cross-account data leaks. This is enforced as a critical invariant across the entire codebase.

AI Safety

When you use AI features, your data is protected by multiple layers:

  • PII Redaction: Before any content is sent to AI providers, our PIIRedactor automatically strips email addresses, phone numbers, social security numbers, credit card numbers, API keys, passwords, and other sensitive patterns.
  • Input/Output Validation: The AI safety pipeline validates all inputs and outputs for content safety and prompt injection attempts.
  • On-Device Option: You can restrict AI features to Apple Intelligence only (fully on-device processing with zero data transmission).
  • No Training: Per the terms of supported AI providers, data sent via API is not used to train their models.

API Key Security (BYOK)

When using Bring Your Own Key, your API keys are stored in the macOS Keychain and sent directly from your Mac to your chosen AI provider over encrypted connections. Unleashed Mail does not operate a cloud relay — your API requests do not pass through our servers, because we don't operate any.

App Sandbox

Unleashed Mail runs in the macOS App Sandbox with minimal entitlements:

  • Network (client/server): Required for email provider APIs and OAuth flows.
  • User-selected files (read-write): For saving and attaching files you choose.
  • Downloads folder (read-write): For saving email attachments.
  • Contacts (read-only): For contact autocomplete and photo display.

No other system resources are accessible. The app is code-signed for tamper protection; Apple notarization is in progress for general release.

Logging & Privacy

  • All log messages use macOS os.log with %{private}@ format specifiers — sensitive data is automatically redacted in system logs.
  • PII is redacted in application logs via PIIRedactor.
  • Debug files are cleaned up on every app launch to prevent data leakage.
  • No third-party analytics or tracking SDKs are integrated.

Responsible Disclosure

If you discover a security vulnerability in Unleashed Mail, please report it to [email protected]. We take all reports seriously and will respond promptly.