Security

Stow exists so that years of your email are not left with someone else. It is built so that the copy on your Mac does not become a new risk.

How Stow protects your archive

It only reads your mailbox

Stow's mail code has a fixed list of commands it can send to a mail server, and every one of them is read-only. There is no way in its code to express sending, changing, moving, flagging or deleting. As a second check, Stow refuses to continue unless the server confirms each folder is open read-only.

Your mail never passes through us

There is no Stow server. Your mail travels over an encrypted connection from Google or Microsoft straight to your Mac.

Everything is encrypted on disk

• The database, including the search index, is encrypted with SQLCipher (AES-256).
• Each message and attachment file is encrypted separately with AES-256-GCM, and a file that has been swapped or renamed fails to open rather than showing the wrong content.
• File names are derived with a secret key, so the archive folder does not reveal whether a particular document is in it.
• Folders and files can be opened only by your macOS user.

The keys stay on your Mac

The encryption keys and your sign-in tokens are kept in your Mac's Keychain, marked so they never sync to iCloud Keychain or leave the Mac. Stow never sees your password: you sign in on Google's or Microsoft's own page. A recovery key, shown once and never sent to us, is the only way to open the archive on another Mac.

The archive stays out of the cloud

Stow refuses to keep the archive in iCloud Drive, Dropbox, Google Drive, OneDrive or other cloud-synced folders, or on network drives.

Old emails can't report back

The reader runs no scripts in emails and blocks images from the internet unless you ask for them, one email at a time, so opening an old email tells the sender nothing.

Logs leave out your mail

Stow's logs stay on your Mac and never contain message content, subject lines, passwords or tokens. Email addresses in them are scrambled. There is no hosted crash reporting.

The app is sandboxed and signed

The Stow app runs in the macOS app sandbox with the hardened runtime, and will be signed with T1G OÜ's Developer ID and notarised by Apple. The engine that does the syncing, encryption and search will be open source, so anyone can check it.

Stow is in development. No independent audit or certification is claimed.

Reporting a vulnerability

If you think you have found a security problem in Stow, the engine or this website, please email security@getstow.ee.

Please include:

• what is affected (app, engine or website) and which version;
• steps to reproduce it, and what an attacker could do with it;
• how you would like to be credited, if at all.

Please don't include real email content, and please give us a chance to fix the problem before you make it public. We will reply to let you know we have received your report.