# Amazon WorkMail privacy rating

Paid business email and calendar service on AWS for custom domains, billed per user. AWS has announced the end of support for WorkMail and no longer accepts new customers.

## Summary

Amazon WorkMail scores 48 out of 100 (grade D) on the email providers criteria. It meets 6 of 15 criteria: transparency report, tells users about requests, TLS configuration, security headers, open protocols and custom domains. It partly meets no ads or data sales, independent audit, end-to-end encryption and encrypted mailbox storage. It does not meet open source, no trackers or telemetry and sign up without personal data. Still needing evidence: Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A.

- Website: https://aws.amazon.com/workmail/
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: none found
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Also rated: [Amazon SES](https://privacyratings.com/email-sending/amazon-ses/) (Email sending services), [AWS End User Messaging SMS](https://privacyratings.com/communications-apis/aws-end-user-messaging-sms/) (SMS and voice APIs), [Amazon Route 53](https://privacyratings.com/dns-hosting/amazon-route-53/) (DNS hosting), [Amazon Web Services](https://privacyratings.com/server-hosting/amazon-web-services/) (Server hosting), [Kindle](https://privacyratings.com/ebook-readers/kindle/) (Ebook readers), [Amazon Alexa](https://privacyratings.com/smart-home/amazon-alexa/) (Smart home), [Amazon Music](https://privacyratings.com/music-streaming/amazon-music/) (Music streaming), [Amazon Photos](https://privacyratings.com/photo-management/amazon-photos/) (Photo management)
- Grade: D (48/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | AWS websites allow cookies from third parties including Google, LinkedIn and The Trade Desk for ads and reporting. | https://aws.amazon.com/legal/cookies/ |
| No ads or data sales | Partial | Funded by per-user fees, and customer content is not used for marketing or advertising. The AWS website uses third-party cookies to show AWS ads on other sites. | https://aws.amazon.com/compliance/data-privacy-faq/ |
| Independent audit | Partial | WorkMail is in scope of AWS SOC audits. Only the SOC 3 summary report is public. The full SOC 2 report is only available to customers. | https://d1.awsstatic.com/onedam/marketing-channels/website/aws/en_US/whitepapers/compliance/AWS_SOC3_Report.pdf |
| Transparency report | Yes | Semi-annual reports with counts of government requests to Amazon and AWS and how they were answered. | https://d1.awsstatic.com/onedam/marketing-channels/website/aws/en_US/security/pdfs/Amazon_Government_Request_Report_H1_2026.pdf |
| Tells users about requests | Yes | AWS gives customers notice of demands for their content unless legally prohibited. | https://aws.amazon.com/compliance/data-privacy-faq/ |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=aws.amazon.com&hideResults=on |
| Security headers | Yes | Grade A (95/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=aws.amazon.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encryption | Partial | S/MIME works in Outlook and some mobile mail apps with a certificate from a third party. Not in the web app and not on by default. | https://docs.aws.amazon.com/workmail/latest/userguide/send_encrypted_email.html |
| Encrypted mailbox storage | Partial | Mailboxes are encrypted at rest with AWS KMS keys. The organization can choose its own KMS key, but AWS decrypts mail when users access it. | https://docs.aws.amazon.com/workmail/latest/adminguide/data-protection.html |
| Open protocols | Yes | IMAP and SMTP work with other apps over implicit TLS. POP3 is not supported. | https://docs.aws.amazon.com/workmail/latest/userguide/using_IMAP.html |
| Custom domains | Yes | Existing domains can be added after ownership is verified. | https://aws.amazon.com/workmail/faqs/ |
| Sign up without personal data | No | An AWS account requires an email address, a phone number that receives a PIN and a valid payment method. | https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-creating.html |
| IMAP support | Not tested yet | Not tested yet. |  |
| POP3 support | Not tested yet | Not tested yet. |  |
| SMTP submission | Not tested yet | Not tested yet. |  |
| Mail transport security | Not tested yet | Not tested yet. |  |
| Sender Rewriting Scheme | Unknown |  |  |
| ARC sealing | Unknown |  |  |

Source: https://privacyratings.com/email-providers/amazon-workmail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/amazon-workmail.md