# Hushmail privacy rating

Paid email service with OpenPGP encryption from Hush Communications in Vancouver, Canada, where its servers are. Most plans are for healthcare, law and small business, and a Personal Use plan is sold to individuals.

## Summary

Hushmail scores 29 out of 100 (grade F) on the email providers criteria. It meets 3 of 21 criteria: TLS configuration, open protocols and POP3 support. It partly meets no ads or data sales, transparency report, modern web standards, end-to-end encryption, custom domains, IMAP support and SMTP submission. It does not meet open source, no trackers or telemetry, independent audit, tells users about requests, security headers, encrypted mailbox storage, sign up without personal data, email security standards, mail transport security, Sender Rewriting Scheme and ARC sealing. It is based in Canada: Five Eyes member. Automated tests: SSL Labs grade A+, Mozilla HTTP Observatory grade F, Internet.nl website score 73% and Internet.nl email score 66%.

- Website: https://www.hushmail.com
- Jurisdiction: Canada. Five Eyes member.
- Platforms: Web, iOS
- Home page trackers: Google Analytics, Google Tag Manager, Trustpilot (not scored)
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Grade: F (29/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The website loads Google Analytics, Google Ads and HubSpot tracking scripts. The privacy policy describes cookies used to understand how people use the services. | https://www.hushmail.com/privacy |
| No ads or data sales | Partial | Funded by paid plans, with no ads in the mail service and no scanning of mail for ads. The website loads Google Ads and HubSpot ad tags, and the privacy policy allows sharing non-identifying data with third parties for advertising. | https://www.hushmail.com/privacy |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | Partial | The privacy policy explains that account data is disclosed only for an order enforceable in British Columbia or in an emergency. No request counts are published. | https://www.hushmail.com/privacy |
| Tells users about requests | No | The privacy policy states that Hush will not tell users whether an order for their data exists. | https://www.hushmail.com/privacy |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.hushmail.com&hideResults=on |
| Security headers | No | Grade F (0/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.hushmail.com |
| Modern web standards | Partial | Score 73% | https://batch.internet.nl/site/www.hushmail.com/22660440/ |
| End-to-end encryption | Partial | OpenPGP encryption is on by default between Hushmail users, and other recipients read encrypted mail on a web page. In webmail and over IMAP and POP the encryption runs on Hushmail's servers. Only the iPhone app encrypts on the device. | https://www.hushmail.com/hubfs/Hushmail-Authentication%20and%20Encryption.pdf |
| Encrypted mailbox storage | No | OpenPGP-encrypted messages are stored encrypted, but the privacy policy states that unencrypted email is stored unencrypted. | https://www.hushmail.com/privacy |
| Open protocols | Yes | IMAP, POP3 and SMTP work with any client on every plan, including Personal Use. | https://help.hushmail.com/article/684-pop-imap-and-smtp-server-hostnames-and-ports |
| Custom domains | Partial | Not on the Personal Use plan. A custom domain needs a Small Business, Healthcare or Law plan. | https://www.hushmail.com/plans/personal |
| Sign up without personal data | No | A free trial needs an alternate email address and a phone number. Paid plans also ask for billing details. | https://help.hushmail.com/article/728-your-personal-information |
| Email security standards | No | Score 66% | https://batch.internet.nl/mail/hushmail.com/22855401/ |
| IMAP support | Partial | imap.hushmail.com:993 (implicit TLS). IMAP4rev1 advertised, no IDLE before login. |  |
| POP3 support | Yes | pop.hushmail.com:995 (implicit TLS). CAPA: TOP, USER, UIDL, SASL. |  |
| SMTP submission | Partial | smtp.hushmail.com:465 (implicit TLS). Missing: SMTPUTF8, 8BITMIME, PIPELINING. |  |
| Mail transport security | No | Passes: SPF, DMARC quarantine. Missing: MTA-STS missing, TLS-RPT, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/hushmail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/hushmail.md