This page describes security controls that are supported by the current EmailDesk implementation and states the limits of those controls.
Reviewed: July 29, 2026EmailDesk uses authenticated sessions, role and permission checks, customer and workspace scoping, login rate limits, two-factor workflows, trusted-device controls, and Turnstile when configured.
Customer administrators control user access within their workspace. Authorized platform administrators have separate operational access for support, security, billing, abuse handling, and system administration.
Mailbox passwords, mailbox app passwords, API credentials, SMTP credentials, WHM access tokens, and provider credentials have different purposes and should not be substituted for one another.
One-time mailbox app passwords are stored as password hashes rather than retained as plaintext. Selected application-managed provider secrets use server-side encryption before storage. Customers must keep every displayed credential out of browser code, source control, screenshots, analytics, and ordinary support messages.
The public website and customer application are served over HTTPS. Current compatible mail-client guidance uses IMAP on port 993 with SSL/TLS, SMTP submission on port 587 with STARTTLS or port 465 with SSL/TLS, and legacy POP3S on port 995 with SSL/TLS.
Plaintext POP3 on port 110 is intentionally disabled. A customer's DNS, device, client version, local network, and external provider can still affect connection security and compatibility.
Inbound and outbound workflows can evaluate authentication, sender and recipient evidence, content, links, attachments, suppressions, velocity, quota, provider responses, and configured policy controls.
Protection can allow, watch, review, quarantine, or block where the applicable workflow supports that decision. Passing SPF, DKIM, or DMARC does not prove safe content, and no control guarantees provider acceptance, final delivery, or inbox placement.
EmailDesk records scoped audit events and operational evidence for supported authentication, administration, sending, delivery, protection, quota, and support actions.
The production service uses health checks, bounded worker records, retention and integrity verification, resource monitoring, and recovery backups. These controls support investigation and recovery but do not create a claim of uninterrupted service or zero data loss.
Existing customers should use the authenticated support desk when a report contains account-specific context.
A security or abuse concern that cannot be submitted through the customer workspace can be sent to abuse@emaildesk.bd. Do not include passwords, API keys, SMTP credentials, mailbox app passwords, WHM tokens, or unrelated customer data.