Mayfair Suite / Security
Security and privacy
How Mayfair Suite protects your account
What we do to keep your mail and files safe, and what staff can and cannot see, in plain words.
Protection built in
Passwords
Passwords are stored as one way PBKDF2 hashes. Nobody, including staff, can read yours.
Sessions
Sign in sessions use random tokens that are stored hashed. Cookies are HttpOnly, Secure and SameSite, so scripts on a page cannot read them.
Two step sign in
Turn on two step sign in with any authenticator app. Backup codes work once each, and you get five tries per sign in.
Recovery email
A recovery email is confirmed by a link first, and reset links only go to a confirmed address. A password reset never skips two step sign in.
Safe to open mail
HTML mail opens in a locked box with no scripts, and remote images are hidden until you choose to show them.
Limits on abuse
Sign in, sign up and booking pages are rate limited per network.
Straight answers
Is my email end to end encrypted?
No. Mail is stored on the service so that search, labels and your other devices work. It is protected in transit by HTTPS.
Can staff read my email?
Staff who run the service can see account details and mail headers (who wrote to whom, the subject, the time and whether there are files). Reading message text needs a written reason, and every such action is written to an audit log with the operator's name.
Who can open the admin tools?
Only named operators, only with two step sign in switched on, and only on a separate private address. Everyone else gets a plain "not found".
What if I forget my password?
If you added and confirmed a recovery email, you can ask for a reset link there. Without one, a password cannot be reset, so add one in Settings.
Read the full privacy policy and terms.