Security
A short, plain-language summary of how we protect QuickInbox and the data that passes through it.
In transit
All traffic to quickinbox.net — the website, the free disposable/permanent email service, and the Business API — is served over HTTPS/TLS. We don't offer an unencrypted HTTP option.
Accounts and credentials
Passwords for permanent-address and Business API accounts are never stored in plain text — they're salted and hashed before being saved. Business API keys are shown to you once, at the moment you create them; after that, we only keep a one-way hash plus a short masked preview, the same way most API-key systems work, so we can't show you a lost key again and neither can anyone who gained access to our database.
Infrastructure
QuickInbox runs on Cloudflare's edge network (Workers, D1, and KV), which handles DDoS mitigation and infrastructure-level security at the platform level. We don't run our own servers to patch or secure.
Abuse prevention
We apply automated rate limiting across signup, login, and address-creation endpoints to make large-scale abuse impractical, and we reserve the right to block traffic patterns that look abusive.
Reporting a security issue
If you believe you've found a security vulnerability in QuickInbox, please email info@sigmaeng.net with details so we can investigate. Please don't test against other users' data or attempt to access accounts that aren't yours.