Email providers
Amazon WorkMail privacy rating
Paid business email and calendar service on AWS for custom domains, billed per user. AWS has announced the end of support for WorkMail and no longer accepts new customers.
Summary
Amazon WorkMail scores 48 out of 100 (grade D) on the email providers criteria. It meets 6 of 15 criteria: transparency report, tells users about requests, TLS configuration, security headers, open protocols and custom domains. It partly meets no ads or data sales, independent audit, end-to-end encryption and encrypted mailbox storage. It does not meet open source, no trackers or telemetry and sign up without personal data. Still needing evidence: Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A.
Score 48 out of 100. How scoring works
Criteria
- No
-
No
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
AWS websites allow cookies from third parties including Google, LinkedIn and The Trade Desk for ads and reporting.
-
Partial
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by per-user fees, and customer content is not used for marketing or advertising. The AWS website uses third-party cookies to show AWS ads on other sites.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
WorkMail is in scope of AWS SOC audits. Only the SOC 3 summary report is public. The full SOC 2 report is only available to customers.
-
Yes
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
Semi-annual reports with counts of government requests to Amazon and AWS and how they were answered.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
AWS gives customers notice of demands for their content unless legally prohibited.
-
Partial
End-to-end encryption Weight 3 of 3
Can mail be end-to-end encrypted so that the provider cannot read message contents?
S/MIME works in Outlook and some mobile mail apps with a certificate from a third party. Not in the web app and not on by default.
-
Partial
Encrypted mailbox storage Weight 3 of 3
Is stored mail encrypted with a key the provider does not hold?
Mailboxes are encrypted at rest with AWS KMS keys. The organization can choose its own KMS key, but AWS decrypts mail when users access it.
-
Yes
Open protocols Weight 2 of 3
Can any standard app connect over IMAP, POP3, SMTP, CalDAV or CardDAV, without extra software?
IMAP and SMTP work with other apps over implicit TLS. POP3 is not supported.
-
Yes
Custom domains Weight 1 of 3
Can mail be sent and received with your own domain?
Existing domains can be added after ownership is verified.
-
No
Sign up without personal data Weight 2 of 3
Can an account be created without a phone number or another email address?
An AWS account requires an email address, a phone number that receives a PIN and a valid payment method.
-
Unknown
Sender Rewriting Scheme Weight 1 of 3
Is the envelope sender rewritten with SRS when mail is forwarded, so forwarded mail keeps passing SPF?
Needs evidence. Add it
-
Unknown
ARC sealing Weight 1 of 3
Does the provider validate and add ARC (RFC 8617) signatures, so authentication results survive forwarding?
Needs evidence. Add it
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Yes
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade A (95/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.
-
Not tested yet
IMAP support Weight 2 of 3
Does the IMAP server accept connections over implicit TLS on port 993 and advertise IMAP4rev1 or IMAP4rev2 with IDLE push?
Not tested yet.
-
Not tested yet
POP3 support Weight 1 of 3
Does the POP3 server accept connections over implicit TLS on port 995 and answer CAPA with UIDL?
Not tested yet.
-
Not tested yet
SMTP submission Weight 2 of 3
Does mail submission work over implicit TLS on port 465 with SMTPUTF8, 8BITMIME, PIPELINING and AUTH?
Not tested yet.
-
Not tested yet
Mail transport security Weight 3 of 3
Does the mail domain enforce encrypted, authenticated delivery with MTA-STS, DANE, DNSSEC, TLS-RPT and an enforced DMARC policy?
Not tested yet.