Security
Angaro is built so that as little as possible passes through our servers – and what is stored there is unreadable to us.
End-to-end encryption
A key is derived from your password on your device using PBKDF2-SHA256 (210,000 iterations). Contacts, settings and mail accounts including passwords are encrypted with AES-256-GCM before they leave your device. Our server never receives your password, only a login hash derived from it, which it additionally stores with scrypt.
Your emails stay with you
The apps fetch emails directly from your provider and store them on your device. The webmailer connects to your mail server for each action and stores neither credentials nor content; an open connection is kept in memory for at most 5 minutes.
Servers in the EU
Angaro Cloud runs in Frankfurt am Main, the push service in Nuremberg, backups are stored in France. Angaro is operated in Austria and is subject to the GDPR.
Safety Check
Every email is checked for forged senders (SPF, DKIM, DMARC), lookalike domains, suspicious links, changed bank details and dangerous attachments. For the blocklist of known phishing domains, only the first characters of a SHA-256 hash are queried – Angaro never sees links from your emails.
Push without insight
For notifications, your credentials are sealed on your device for the push service’s key (ECIES with P-256 and AES-256-GCM). Only that service can open them. Sender and subject are delivered encrypted for your device.
Encrypted emails (PGP)
PGP keys are created on your device. The private key is only synced end-to-end encrypted; encryption and decryption take place exclusively on your device.
Hardened servers
HTTPS with HSTS everywhere, emails are shown without scripts or forms in an isolated frame, connections to internal networks are blocked, sign-ins and lookups are rate-limited. Dependencies are regularly checked for known vulnerabilities.
Report a vulnerability
Found a vulnerability? Email us at support@angaro.io with the subject “Security” and a short description of how to reproduce it. We will reply as quickly as possible and keep you updated until it is fixed.
Please do not access other people’s data, do not modify or delete anything and do not put load on our services (no denial-of-service attacks). If you follow these rules and report the issue to us first, you need not fear legal action from us.
Machine-readable: angaro.io/.well-known/security.txt
support@angaro.io