Security by architecture
Inboxwell minimizes the systems that stand between you and your mail provider. Here is the current security model in plain language.
Effective August 12, 2026
Direct provider connections
The desktop app connects directly to Google APIs, Microsoft Graph or your configured IMAP/SMTP server over encrypted transport. Inboxwell does not proxy message content through its own backend.
OAuth instead of passwords
For Gmail and Microsoft 365, sign-in happens on the provider's own authorization page. Inboxwell receives tokens limited to the permissions displayed during consent and never receives your provider password.
Protected local storage
- Mailbox cache and the search index are stored in a locally encrypted SQLCipher database.
- OAuth tokens are stored using Windows Credential Manager.
- App settings and signatures remain on the device unless you explicitly export or synchronize them through another tool.
Remote images
Remote images can improve message fidelity but may allow a sender to learn that a message was opened. The Security settings let you block remote images when needed.
Open-source review
The source is available on GitHub. Security issues should be reported privately by email rather than posted publicly before a fix is available.
Report a vulnerability
Email support@gosho.app with the affected version, impact, reproduction steps and any suggested mitigation. Please do not access another person's data or disrupt services while researching an issue.