Back to sift.mx

Security

Built to protect your real inbox.

sift.mx combines authenticated intake, encrypted quarantine storage, short retention, and private forwarding to keep senders away from your destination address.

Last updated August 1, 2026

Protection starts before delivery

Your private inbox is never shown to senders. Messages are authenticated, checked against your rules, encrypted before quarantine storage, and removed after delivery or expiry.

The public address you share and the destination inbox you already use stay separated. Replies continue through opaque sift.mx addresses, so normal correspondence does not reveal where your mail is forwarded.

What happens to a message

  1. Cloudflare Email Routing receives the message and passes it to the sift.mx mail worker.
  2. sift.mx checks sender authentication, including SPF, DKIM, and DMARC results, plus loop, rate-limit, and size controls (messages over 10 MB are dropped before quarantine storage).
  3. The complete message is encrypted with AES-256-GCM before being stored in the private quarantine bucket.
  4. Sender rules determine whether the message is whitelisted, held behind a cover to be sifted in, or sifted out.
  5. For delivery, the mail worker decrypts the message in memory, prepares the private forward, and sends it to the verified destination inbox.
  6. Delivered content is removed from quarantine storage. Unpaid content expires within seven days.

Email forwarding is not end-to-end encrypted

Email through name@sift.mx is a forwarding product. sift.mx encrypts quarantined MIME at rest with AES-256-GCM, then decrypts in memory to forward to your verified inbox. That protects storage and hides your private address — it is not end-to-end encryption of email contents against sift.mx.

End-to-end chat

Sift chat (member ↔ member in the web and mobile apps) is end-to-end encrypted. Message bodies are encrypted on your devices before upload. Servers store ciphertext, sealed device keys, and payment metadata only. There is no server-held plaintext backup: if you lose your devices and keys, chat history cannot be recovered — including by resetting your password or 2FA.

Protocol details and the threat model are documented in the repository at docs/chat-e2e.md.

What we protect

Your private destination

Your forwarding address is encrypted in our database and is not disclosed to senders or exposed on payment pages. Replies use opaque sift.mx addresses so normal correspondence can continue without revealing your private inbox.

Quarantined content

Raw message bodies and attachments are encrypted at rest. The member dashboard shows sender and subject metadata for a held message, but it does not expose the quarantined body or attachments.

Sensitive identifiers and tokens

Sender addresses, forwarding addresses, subjects, and contact rules are encrypted where appropriate. Challenge, verification, and reply tokens are stored as one-way digests rather than reusable plaintext tokens.

Retention and deletion

  • Unpaid quarantined message content expires within seven days.
  • Successfully delivered content is removed from quarantine storage as part of delivery.
  • Blocked, deleted, expired, and other terminal content is removed by the scheduled purge, normally within an hour.
  • Delivery metadata, authentication results, financial records, ledger entries, and audit events may remain for security, reconciliation, and legal purposes.
  • Reply tokens expire after 90 days; payment challenge tokens expire after 72 hours.

Accounts and abuse controls

sift.mx supports passwordless magic links, optional Google sign-in, session protections, and two-factor authentication. Changing a forwarding destination or lowering auto-pay limits requires a two-factor step-up. Message and quarantine actions are scoped to the recipient account.

Inbound mail is screened for authentication failure, loops, backscatter, duplicate messages, invalid aliases, and excessive send rates before it can reach a recipient.

Payments stay separate from content

Stripe receives the purchase amount, funding option, and an internal payment reference. sift.mx does not send Stripe the message body, attachments, private destination inbox, or contact rules. Signed Stripe webhooks—not browser redirects—are the source of truth for settlement.

Infrastructure we rely on

sift.mx uses Cloudflare for email routing, workers, encrypted object storage, queues, and observability; Neon for PostgreSQL; Stripe for card payments; and Google only when a member chooses Google sign-in. These providers operate under their own security and privacy practices.

A note on message processing

To apply your rules and forward mail, sift.mx processes message content inside its controlled mail infrastructure. Quarantined content is encrypted at rest, access is restricted, and retention is kept short. sift.mx is a forwarding service rather than an end-to-end encrypted messaging product; use a purpose-built encrypted channel for material that requires end-to-end secrecy.

Report a security concern

If you believe you found a vulnerability or confidential-data issue, email hello@sift.mx with enough detail for us to reproduce it. Please do not include live message content, credentials, or payment data in the report.