Security, stored email and your data rights
How Mailyoto encrypts connections, protects your sign-in, decides what email it stores and for how long, and handles your data rights.
Updated 31 October 2026
Mailyoto encrypts its connections, stores only the email detail you choose, and deletes your logs when their retention ends.
Connections#
| connection | protection |
|---|---|
| The website, the dashboard and the API | HTTPS. |
| Servers delivering email to Mailyoto | Mailyoto offers STARTTLS on every connection. |
| Mailyoto delivering email to a destination | Mailyoto uses TLS whenever the destination’s server supports it. For a domain that enforces MTA-STS, Mailyoto delivers only over TLS and checks the server’s certificate (SMTP ports and TLS). |
Your mail app sending through smtp.mailyoto.com | The app must start TLS before it signs in. Port 587 with STARTTLS, or 465 with TLS from the start. |
An app that tries to sign in without TLS gets this response:
538 5.7.11 Encryption required for requested authentication mechanismYour account#
- Mailyoto stores your password only as a hash. A password has at least
8characters. - Two-factor authentication adds a 6-digit code from an authenticator app to every sign-in.
- Each authenticator code works once.
- Passkeys let you sign in with your device instead of a password.
- Mailyoto allows
10sign-in attempts a minute per IP address and5a minute per account. - A signed-in device signs out after
7days unused. - Every device signs out
21days after it signed in, even in use. - Signed-in devices on the Account page lists each device and its country, and signs any of them out.
- Changing your password signs out every other device.
- Account activity on the Account page lists the changes made on your account in the last
13months.
The email Mailyoto keeps#
You choose what Mailyoto logs about each email, in Email logs on the Account page. A domain’s Usage and logs tab can give it switches of its own.
Every log keeps the delivery events: when the email arrived, where it went and how each delivery ended.
| switch | what Mailyoto adds when it’s on |
|---|---|
| Keep subjects and addresses | The sender, the subject and the destination. Off, Mailyoto stores them only as a one-way hash. |
| Keep the full content of failed email | A copy of each email it refuses or can’t deliver, which you can download from the log entry. |
| plan | Delete logs after |
|---|---|
| Free | 1 to 10 days |
| Pro | 1 to 60 days, 14 until you change it |
| Max | 1 to 365 days, 14 until you change it |
When the retention period ends, Mailyoto deletes the logs. The privacy policy says how long Mailyoto keeps an email that failed to deliver. Clear history on a domain’s Usage and logs tab deletes every log entry and stored message for that domain at once. Deleting your account stops forwarding at once, and a daily job deletes your data a day later.
Webhooks#
Mailyoto signs each webhook request with your domain’s secret, as an HMAC-SHA256 of the timestamp and the body. Your server can check that a request came from Mailyoto: see check that a request came from Mailyoto.
Your data rights#
The privacy policy sets out the data Mailyoto processes, where its providers process it, and your rights under data-protection law, such as the GDPR. It also explains how to ask for a copy of your data or its deletion. The security page summarises the rest.