# Thundermail privacy rating

Paid email, calendar and contacts service from MZLA Technologies, the Mozilla subsidiary that makes Thunderbird. Built on the Stalwart mail server, with data hosted in Germany. In beta and open only by invitation from a waitlist.

## Summary

Thundermail scores 40 out of 100 (grade D) on the email providers criteria. It meets 4 of 21 criteria: open source, open protocols, custom domains and SMTP submission. It partly meets no ads or data sales, TLS configuration, security headers, modern web standards, end-to-end encryption, encrypted mailbox storage, email security standards and IMAP support. It does not meet no trackers or telemetry, independent audit, transparency report, tells users about requests, sign up without personal data, POP3 support, mail transport security, Sender Rewriting Scheme and ARC sealing. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade B, Mozilla HTTP Observatory grade B, Internet.nl website score 75% and Internet.nl email score 72%.

- Website: https://tb.pro
- Source code: https://github.com/thunderbird/thunderbird-accounts
- License: MPL-2.0
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: none found
- Category: [Email providers](https://privacyratings.com/email-providers/)
- Grade: D (40/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | The account service, webmail and deployment code are published under MPL-2.0. The mail server is Stalwart, which is AGPL-3.0 with some enterprise features under a source-available license. | https://raw.githubusercontent.com/thunderbird/thunderbird-accounts/main/LICENSE |
| No trackers or telemetry | No | The home page loads no third-party trackers, but the privacy policy allows third-party analytics cookies. The account service sends sign-up and login events to PostHog under a hashed user ID. | https://tb.pro/en-US/privacy/ |
| No ads or data sales | Partial | Funded by subscriptions, with no ads in the service. The privacy policy states that identifiers and browsing data are shared with analytics providers and social networks in the sense of US state privacy law. | https://tb.pro/en-US/privacy/ |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report covers Thundermail. Mozilla's reports cover Mozilla Corporation, and MZLA is a separate company. | https://www.mozilla.org/en-US/about/policy/transparency/guidelines/ |
| Tells users about requests | No | No published policy on notifying users about data requests. The privacy policy only says data may be disclosed to authorities in response to lawful requests. | https://tb.pro/en-US/privacy/ |
| TLS configuration | Partial | Grade B | https://www.ssllabs.com/ssltest/analyze.html?d=tb.pro&hideResults=on |
| Security headers | Partial | Grade B (70/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=tb.pro |
| Modern web standards | Partial | Score 75% | https://batch.internet.nl/site/tb.pro/22660125/ |
| End-to-end encryption | Partial | OpenPGP is built into the Thunderbird app but needs a key set up for each account. Files sent with Send are end-to-end encrypted. | https://support.mozilla.org/en-US/kb/openpgp-thunderbird-howto-and-faq |
| Encrypted mailbox storage | Partial | Mail is stored on encrypted AWS disks and S3 buckets, with keys the provider holds. The privacy policy lists cases in which staff may access mail. | https://raw.githubusercontent.com/thunderbird/mailstrom/main/pulumi/stalwart/s3.py |
| Open protocols | Yes | IMAP, SMTP and JMAP work with any client. POP3 is not offered. | https://tb.pro/en-US/ |
| Custom domains | Yes | The Early Bird plan includes up to three custom domains. | https://tb.pro/en-US/ |
| Sign up without personal data | No | An existing email address is required to join the waitlist and verify the account. A paid subscription is also required. | https://tb.pro/en-US/waitlist/ |
| Email security standards | Partial | Score 72% | https://batch.internet.nl/mail/thundermail.com/22855392/ |
| IMAP support | Partial | mail.thundermail.com:993 (implicit TLS). IMAP4rev2 advertised, no IDLE before login. |  |
| POP3 support | No | Not offered. |  |
| SMTP submission | Yes | mail.thundermail.com:465 (implicit TLS). SMTPUTF8, 8BITMIME, PIPELINING and AUTH advertised. |  |
| Mail transport security | No | Passes: SPF, DMARC reject, TLS-RPT. Missing: MTA-STS testing, DNSSEC, DANE none. |  |
| Sender Rewriting Scheme | No | No published documentation on SRS for forwarded mail. |  |
| ARC sealing | No | No published documentation on ARC signing or validation. |  |

Source: https://privacyratings.com/email-providers/thundermail/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/email-providers/thundermail.md