Security at Bhayo

🔐 Signing in

• No passwords to steal or reuse. To sign in, you approve the request from the email we send you.
• Number matching: the screen you’re signing in on shows a number; you tap the same number on the approval page. Someone who only knows your email can’t guess it — two wrong taps block the attempt.
• Every sign-in email shows which device and place asked, and has an “It wasn’t me — block it” button.
• Links and codes work once and expire after 10 minutes. Attempts are limited per email and per connection.
• Bhayo staff will never ask you for a code or to approve a sign-in.

🛡 2-step verification (optional, recommended)

• Passkey — Face ID, fingerprint or Windows Hello. The secret key stays in your device’s security chip; we only keep the public half.
• Authenticator app — Google Authenticator, Microsoft Authenticator and others. Each code works once.
• Backup questions — 2 random questions out of 4 you choose. Only a backup, never enough on their own; 3 wrong answers lock them for 24 hours.
• Turning protection off needs a fresh sign-in.

📱 Your devices

• Settings → Security lists every device signed in to your account — what it is, where, and when it was last active.
• Remove any device, or sign out of all others, in one tap.

🔒 Encryption

• In transit: everything uses HTTPS. Email between mail servers is encrypted (TLS, with MTA-STS so other servers must use it).
• At rest: your data and files are stored on Cloudflare, which encrypts them on disk (AES-256).
• Sign-in links, codes and device keys are stored only as one-way hashes. Passwords of mailboxes you connect from other providers, and authenticator secrets, are stored encrypted. Backup answers are hashed with a server-only secret.
• Mail from @bhayo.com is signed (DKIM) and protected by SPF and DMARC, so others can’t easily fake our addresses.

📎 Files and attachments

• Every upload is checked by its real content, not its name. Programs, scripts and web pages are refused.
• Private files open only through signed links that expire (in the app they refresh by themselves). An old or leaked link stops working, and a link can’t be changed to open someone else’s file.
• Files are stored in a separate folder per person, and are deleted when you delete your account.

💾 Backups

• The mail server is backed up every night, encrypted before it leaves the server, to separate storage (7 daily, 4 weekly, 6 monthly copies). Restores are tested.

🤖 Bots, spam and abuse

• Limits on sign-ins, sign-ups, messages and emails per person and per connection.
• A human check (Cloudflare Turnstile) can be required on sign-in and sign-up — privacy-friendly, usually invisible.
• Anyone can report a profile, business, post, job or comment. Our team reviews reports; accounts can be suspended, with an appeal.

👥 Who at Bhayo can see what

• Only a small team, through a separate staff console with one-time sign-in codes, roles and an audit log of every action.
• Verification documents you send us are private and deleted after review.

✋ Your control

• Delete your account from inside the app — it removes your pages, mailboxes, files and personal data.
• Read our Privacy Policy and Terms.

🧭 What we’re still working on

• Moving stored mail to encrypted storage on the mail server.
• Downloading a copy of all your data from the app.
• Phone verification (WhatsApp, then SMS) for new accounts.
• Passkeys inside the iPhone and Android apps (they work in the browser now).
• An independent security review.

🐞 Found a security problem?

Please email security@bhayo.com with the details. Don’t access other people’s data or disrupt the service. We’ll reply, fix it, and thank you.