What is implemented
The website and registration service use HTTPS. Passwords are verified with scrypt, and raw session secrets are not stored in the database. Same-origin checks, rate limits and bounded password-processing concurrency protect registration.
Mail’s server user, database and keys are separate from Messenger. The web API manages only your pending account and web session; it has no email-reading, device-key or E2EE activation endpoint.
What is unfinished
Manual IMAP/SMTP connections and encrypted local mail storage are available in the macOS app. Google access is limited to test accounts; Microsoft publisher verification is pending. General rollout of @us2usmail.com internal E2EE and multi-device recovery is unfinished.
Three different protections
TLS protects the connection between a device and server. Local encryption is for data saved on a computer. E2EE means content is encrypted on the sending device and decrypted on the receiving device.
Ordinary external email is not E2EE. An @us2usmail.com address alone is not proof either. Unverified native keys must never silently fall back to plaintext.
Account recovery
Web password recovery is not available yet. Keep your early-registration password in a trusted password manager. Resetting an account password in the future will not automatically restore lost email encryption keys.
If you find a problem
Contact us through the support page with reproduction steps and an app version. Don’t send a password or another person’s private data. We do not claim cryptography is absolutely unbreakable by AI or every possible attack.