TurnMail Security Overview

Your Data. Your Control.

TurnMail is built for people who rely on their inboxes every day, which means security isn’t optional. We’ve designed TurnMail to follow modern security best practices from day one and continue improving as we grow.

Account Security

Multi-Factor Authentication (MFA)

To protect your TurnMail account, we offer MFA using:

  • Email verification codes

This adds a second layer of security, ensuring that even if someone learns your password, they still can’t access your TurnMail account without your verification code.

Password Storage

All passwords are stored using industry-standard secure hashing algorithms. We never store plain-text passwords.

Email Access & Permissions

OAuth Authentication

TurnMail connects to Gmail and Microsoft 365 using OAuth 2.0. This means:

  • We never see your email password.
  • You can revoke TurnMail’s access at any time via Google/Microsoft security settings.
  • Access is limited to the permissions you explicitly approve.
  • IMAP credentials are store securely and can be removed when you remove your account.

Data Handling

Encryption in Transit

All communication between your browser, TurnMail servers, and email providers uses HTTPS/TLS 1.2+ encryption.

Encryption at Rest

All stored data is encrypted at the server level. We are also implementing application-layer encryption, where sensitive message content will be encrypted using user-specific keys (AES-256-GCM).

Email Storage

TurnMail temporarily stores:

  • Message metadata
  • Email bodies for up to 60 days.

This enables fast loading, search, and TTS reading.

Emails marked as “purged” are securely wiped and overwritten from our system.

We never sell or share email contents with any third parties. Ever. This data is encrypted so even we can’t see the contents.

Text-to-Speech (TTS) Security

If you use TurnMail’s driving-mode TTS feature:

  • Only the text being read is temporarily sent to Google Cloud TTS.
  • No personal identifiers are sent.
  • Audio files are cached for a very short period and then securely deleted.

Mailbox Actions (Read-Only by Design)

TurnMail does not allow deleting, moving, or modifying emails. This is intentional.

TurnMail is built for safe reading and quick access, especially in a driving environment. Preventing irreversible mailbox actions protects you from accidental data loss and keeps high-risk operations inside your primary email app, where they belong.

You can flag and mark emails as read, but that’s it. We will look to potentially review this as we receive feedback from our user base.

Infrastructure Security

Server Architecture

TurnMail is hosted on modern cloud infrastructure with:

  • Isolated backend servers
  • Managed encrypted databases
  • Firewalls preventing public DB access
  • Automated updates and patching

Access Control

Only TurnMail’s backend services can access stored mail data which requires decryption. Administrative access is extremely limited and fully audited.

Your Privacy

We don’t look at your emails.
We don’t train any models on your data.
We don’t sell your data.
We don’t share it with advertisers.

TurnMail exists to read your inbox, not to add to it.

Security Roadmap

We’re committed to continually strengthening TurnMail’s security. Near-term improvements include:

  • Expanding application-layer encryption across more stored content
  • Adding additional MFA options
  • Improving audit logging and internal access controls
  • Self Service Account Purge