Security

Last updated 3 August 2026

Disposable mail is a security problem by nature: strangers' messages, opened in a browser, on a shared address. Here is how we contain it.

Inbox access

Each inbox has a 256-bit secret. We store only its hash, and the address itself grants nothing. There is no inbox search and no way to enumerate what exists, so knowing an address is never enough to read it.

Reading mail safely

HTML is cleaned on the server before it reaches your browser. Scripts, forms and embedded frames are removed, and what remains is displayed inside a locked-down frame that cannot run code or reach the page around it. Remote images stay blocked until you ask, which stops senders learning that you opened the message. Every link shows its real destination, and we flag any whose visible text points somewhere else.

Attachments

We identify the real file type rather than trusting the extension, and mark executable formats as dangerous. Nothing is ever opened or executed on our side.

Separation

Disposable mail runs on its own systems and its own storage, kept apart from the business mail Bolrach Technologies operates. One is never allowed to affect the reputation of the other.

Accounts and keys

Signing in goes through AUTHVIO; we never see a password. The session cookie is bound to this site and cannot be read from a subdomain. An API key is stored as a hash and its first few characters, so a lost key can be recognised in your list and revoked, and a test key is confined to sandboxes so a leaked one cannot touch production.

Reporting a vulnerability

Email legal@tmailr.com with the detail and we will come back to you. Please give us a reasonable window to fix anything before publishing it, and do your testing against your own inboxes and keys rather than other people's data.