Security is not a feature. It is our architecture.
Privacy was not bolted on as an afterthought. This is how FAE was built from the ground up.
How emails flowthrough FAE
FAE operates as a proxy between the internet and you. No email provider is replaced, none is bypassed. Your real email address exists exclusively in our auth system — it is never exposed to any sender or recipient.
The entire mail flow runs through AWS SES (Simple Email Service) with EU infrastructure. Every incoming message passes through the following stages:
Inbound Email Flow
What happens when someone emails your alias
Reply Flow (reversed)
Your real email appears nowhere in the flow.
Neither the original sender nor the recipient of your reply ever sees your real address. It exists exclusively in our encrypted auth system.
AES-256-GCM at rest.TLS 1.2+ in transit.
Every email stored in FAE is encrypted with AES-256-GCM — the same standard used by financial institutions and governments worldwide. In transit, TLS 1.2+ secures every connection. There is no point in the entire data flow where content exists unencrypted.
| Aspect | Standard | Details |
|---|---|---|
| Storage (at rest) | AES-256-GCM | All email content, metadata, and attachments in S3 and database |
| Transmission (in transit) | TLS 1.2+ | All connections: SES receiving, API communication, app sync |
| Auth data | bcrypt + salt | Passwords are never stored in plaintext |
| API communication | HTTPS only | No unencrypted HTTP traffic — strict HSTS |
| Push notifications | APNs (TLS) | Apple Push Notification Service with encrypted connection |
“We don't read your emails. We don't analyze them. We don't sell anything. Our only source of revenue is your subscription.”
GDPR is not a feature.It is the foundation.
All data is stored in the European Union — AWS eu-west-1 (Ireland). No data transfers to the US, no Cloud Act, no compromises. GDPR rights under Articles 15-20 are built directly into the app — no support ticket needed.
Right of Access
See what data we store about you at any time — accessible directly in the app.
GDPR Art. 15Rectification
Correct inaccurate data yourself at any time through your profile.
GDPR Art. 16Right to Erasure
Delete your account and all data — immediately and irreversibly. One tap.
GDPR Art. 17Data Portability
Export all your data in a machine-readable format.
GDPR Art. 20| Requirement | Status | Implementation |
|---|---|---|
| EU data storage | Active | Exclusively AWS eu-west-1 (Ireland) |
| Data Protection Officer | Contact | privacy@fae-mail.com |
| DPA (Data Processing Agreement) | Available | On request for B2B customers at /dpa |
| Privacy by Design | Implemented | Minimal data collection, purpose limitation, alias isolation |
| Consent management | Implemented | Opt-in for marketing, granular push settings |
Who processesyour data?
Transparency is non-negotiable. Every service involved in processing your data — visualized with data flow, purpose, and location.
Email Pipeline
Email receiving & sending
Email storage
Serverless logic
Database & Auth
Database & authentication
Website hosting
Payments & Distribution
Subscription management
No email content, no PII. Only subscription metadata.
Push & distribution
Device token + app metadata. No email content.
FAE App · iOS · Encrypted connection
All email data stays in the EU.
The entire email pipeline — receiving, storage, processing, sending — runs exclusively on EU infrastructure (AWS eu-west-1, Ireland). Services outside the EU receive no email content and no personal data.
Zero tolerancefor abuse.
FAE is a privacy tool — not a vehicle for spam, harassment, or illegal activity. We take every abuse report seriously and act quickly.
Report abuse from a @fae-mail.com address
If you have received unwanted emails from a @fae-mail.com address, report it to us:
abuse@fae-mail.comPlease include the following information:
- 1The full email headers of the unwanted message
- 2The @fae-mail.com address the message came from
- 3A brief description of the issue
- 4Your contact details for follow-up (optional)
We respond to all abuse reports within 24 hours. Violations of our terms of service result in immediate account suspension.