Security Overview

1. Architectural Security Principles

The security architecture of OmniMail uses account isolation, encrypted credential storage and bounded temporary data access:

• Cryptographic Protection: Mailbox app passwords and provider OAuth tokens are encrypted at rest with AES-256-GCM. The server decrypts them to contact the provider; this is not end-to-end encryption.
• Database Multi-Tenant Isolation: Enforced at the engine level via PostgreSQL Row Level Security (RLS) policies.
• Bounded Ephemeral Window: Access to cached mail and staged attachments expires after 600 seconds (10 minutes). Physical cleanup may occur later.
• Short-Lived Delegation: MCP client tokens are capped to a maximum 10-minute expiry window.

2. Vulnerability Disclosure

We welcome responsible security research. If you discover a vulnerability or security concern, contact our security team at: security@omnimail.tech.