Security and privacy, explained plainly

Sign in with a passkey, or with a password plus an authenticator code. Backup codes cover a lost phone.

Passwords need at least 12 characters, are checked against a list of breached passwords and are stored in a scrambled form that is deliberately slow and costly to crack.

A sign-in from a new device triggers an alert. You can review active sessions, end any of them or sign out everywhere.

Sign-in attempts are rate-limited per address and per account, and sign-up uses a short automatic check in your browser instead of a third-party puzzle. Sign-up can be limited to invitations, and role addresses and look-alike names are reserved.

Mail, calendar and contacts apps on your phone or computer always sign in with an app password; your account password is never accepted there. Each app password can be revoked on its own.

Repeated wrong passwords lock sign-in for a while, per address and per account, with one count shared by every app that signs in to your account. Guessing from many addresses at once doesn’t get far.

A new phone is approved by matching a number on a device you already trust, or with an email or 2-Step code.

Each mobile app holds a key that cannot leave the phone’s secure hardware, and signs every request with it. A copied sign-in is useless on its own.

Lost a phone? Sign it out or wipe Woosool data from it in your account’s security settings.

Aman encrypts everything in your browser with strong encryption, using keys made from your master password in a way that is deliberately slow and costly to guess. Woosool stores only encrypted data and cannot reset your master password.

Stored mail and its attachments, files you upload to Khazna, and Lamma attachments are encrypted at rest with strong encryption. Your mail is delivered securely to providers that support it, and always to those that require it.

Woosool Barid supports end-to-end encrypted email that works with other secure email apps, with personal encryption keys or with certificates issued to your organisation. Both work in the browser; the Android app supports personal keys, and certificates are web only for now. Messages and attachments are encrypted on your device before they are sent; only your recipients’ keys can decrypt them, and Woosool’s servers store and deliver encrypted text they cannot read.

Your private key is protected by a passphrase only you know. The optional key backup is encrypted with that passphrase, strengthened so it is slow and costly to guess; Woosool never sees it and cannot reset it. Encryption is automatic when every recipient has a key, which Barid looks up for you, and it works with other secure email apps.

For people without encryption, you can send a password-protected message they open in their browser; it expires after up to 30 days. They can reply encrypted from the same page, attachments included.

Encrypted mail works with Bcc: each Bcc recipient gets a separate encrypted copy, so no one can tell who else received it. Certificates are checked to make sure they have not been withdrawn.

Save someone’s encryption key on their Woosool Nass card, and Barid uses it to encrypt your messages to them.

Turn on end-to-end encryption in Wasla and the key lives only in the meeting link. It covers audio, video, chat and whiteboard images, and disables recording.

Lamma messages and documents are encrypted in transit but not end to end, so features like search and collaboration work on the server. Mail is end-to-end encrypted only when you encrypt it. Even then, the sender, recipients, date and size of a message remain visible to mail servers (the subject is hidden by default), and encrypted messages can’t be searched by their content or scanned for spam or viruses.

Incoming mail is checked to confirm it really comes from the sender’s domain, goes through spam filtering and is scanned for malware. If the scanner is down, mail waits rather than arriving unscanned.

Messages that fail sender authentication are flagged, and remote images are blocked until you choose to load them.

Your mail is delivered securely to providers that support it, and Barid checks it is talking to the right server. When a recipient’s provider requires secure delivery, mail is never sent unencrypted: if the server can’t be verified, delivery waits and retries. Push notifications to your devices carry no message content.

Daily reports on secure delivery and sender checks are sent to domains that request them, and the reports other providers send about your own domains appear in the admin console.

Every file uploaded to Khazna, Qalam, Jadwal, Sard, Fikra, Sual, Lamma, Injaz and Loon is scanned for malware, and refused if the scan cannot run.

Khazna links can have a password, an expiry date and downloads turned off. Revoking a link takes effect immediately.

Organisations get an audit log in the Enterprise panel, and Lamma, Aman and Injaz keep their own logs for administrators.

Set minimum password length, require 2-Step Verification, limit session length, allow passkeys and control which groups can use which apps.

Export your account data at any time. Deleting your account needs your password and has a 14-day grace period you can cancel.

Woosool apps load no third-party scripts, and security emails contain no tracking pixels or remote images.