# ImprovMX privacy rating

Email forwarding service for custom domains, with aliases, catch-all addresses, forwarding rules and SMTP sending on paid plans.

## Summary

ImprovMX scores 34 out of 100 (grade F) on the email forwarding and aliases criteria. It meets 4 of 15 criteria: no ads or data sales, TLS configuration, custom domains and Sender Rewriting Scheme. It partly meets no stored mail, open protocols and ARC sealing. It does not meet open source, no trackers or telemetry, independent audit, transparency report, tells users about requests, security headers, end-to-end encryption and sign up without personal data. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade D-.

- Website: https://improvmx.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Home page trackers: Google Fonts (not scored), Intercom (not scored)
- Category: [Email forwarding and aliases](https://privacyratings.com/email-forwarding/)
- Grade: F (34/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. | https://improvmx.com/guides/why-are-you-not-open-source/ |
| No trackers or telemetry | No | The website loads the Intercom chat widget, and the privacy policy describes receiving data from advertising networks such as Google and LinkedIn. | https://improvmx.com/transparency/privacy-policy/ |
| No ads or data sales | Yes | Funded by paid plans. The privacy policy states that personal information is not sold. | https://improvmx.com/pricing/ |
| Independent audit | No | No independent audit is published. Annual penetration tests are described, but no report is public. | https://improvmx.com/guides/are-you-soc2-or-iso27001-compliant/ |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=app.improvmx.com&hideResults=on |
| Security headers | No | Grade D- (25/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=app.improvmx.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | No | Not supported. Forwarded mail is not encrypted end to end. |  |
| No stored mail | Partial | Mail is stored temporarily for delivery and then deleted. Undelivered mail is kept when the full log level is chosen. | https://improvmx.com/transparency/security-and-reliability/ |
| Open protocols | Partial | SMTP sending is included on paid plans. There is no IMAP or POP3 because mail is forwarded to another mailbox. | https://improvmx.com/guides/improvmx-imap-pop-and-incoming-protocols/ |
| Custom domains | Yes | Works with custom domains on every plan, including the free one. | https://improvmx.com/pricing/ |
| Sign up without personal data | No | An existing email address is required to create an account and receive forwarded mail. |  |
| Mail transport security | Not tested yet | Not tested yet. |  |
| Sender Rewriting Scheme | Yes | The envelope sender of forwarded mail is rewritten to a domain ImprovMX controls. | https://improvmx.com/guides/do-you-support-srs-sender-rewriting-scheme/ |
| ARC sealing | Partial | Forwarded mail is ARC signed, but inbound ARC chains are not validated. | https://improvmx.com/guides/do-you-support-arc-authenticated-received-chain/ |

Source: https://privacyratings.com/email-forwarding/improvmx/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-forwarding/improvmx.md