Help & what's new

How sarebamail works, what is stored and what changed in recent versions.

Sign-in and mailboxes

You sign in with the address and password of your mailbox on the mail server. You change the password on the mail server, not in sarebamail.
After several failed attempts, sign-in is blocked for a while.
Shared mailboxes, delegations and further mailboxes of your own appear in the mailbox switcher.
Mailboxes on the sarebamail mail server – such as postmaster@ or a second @sarebamail.com address – can be added under “Add mailbox” → “sarebamail” with their address and password. They appear in the mailbox switcher and under “All inboxes”, and you can send from them. A wrong password counts as a failed attempt for that mailbox. If its password changes, access ends; remove it and add it again.
Mailboxes at other providers: under “Add mailbox” → “Other service provider”, Gmail, GMX, WEB.DE, Yahoo, iCloud and Telekom come with ready-made server settings; with “Other provider (IMAP)” you enter the servers yourself. Gmail, Yahoo and iCloud require an app password, GMX and WEB.DE IMAP access turned on – the note below the choice says what the provider needs. Outlook.com, Hotmail and Microsoft 365 follow with the Microsoft sign-in.
After signing in, the overview shows everything at a glance: mailbox figures, appointments for the next seven days, the latest mail, chats with unread messages and open tasks. One click opens the mail, the chat or the calendar; you can tick off tasks right there, and “Call” or the buttons on a chat row start a call straight away. The columns adapt to the window width.
“New in sarebamail” shows the latest changes (all under “Updates”), “News” shows announcements from the operator and headlines in the interface language. The server fetches the headlines; the news site learns nothing about you until you open a link.
Create account: When registration is open, the sign-in page shows “Create account”. You choose an address on the sarebamail mail server and enter an existing email address as contact. Until you have confirmed the link in the mail to that address, you can receive but not send; “Send link again” is in the notice at the top of the app.
“I don't have an email address yet”: stricter rules apply to this option so accounts are not used for spam – depending on the settings, a trial period with limits for messages to addresses outside sarebamail, a confirmation by SMS or approval by the operator. Which apply is shown on the page before you submit and afterwards in the notice at the top of the app. Within sarebamail there is no such limit.
Spam filter when sending: the spam filter checks every message before it goes out. If it rejects one, you get a report and a notice at the top of the app – nothing is blocked. A message counts once, no matter how many recipients. Forwarded messages and mailing lists do not count. For Free accounts, sarebamail pauses sending to outside addresses only after several rejections (default: 3 in a day if at least one in ten of your messages is affected, or 3 within 10 minutes), for one hour; within sarebamail it continues. Blocking only happens after many rejections with a high share or after the third pause in a week; only the operator can then unblock. Pro accounts are never paused automatically.
When creating the account, the browser briefly solves a task to slow down automatically created accounts – without picture puzzles and without third parties. Only a few accounts can be created per connection and day.
Forgot password: for sarebamail mailboxes with a confirmed contact address, “Forgot password?” on the sign-in page sends a link to the contact address. It is valid for 30 minutes and only once; afterwards all sessions and paired devices are signed out. Without a contact address this is not possible.
When your password is changed – by you or via “Forgot password” – sarebamail sends an email with the time to your contact address. If that was not you, contact the operator.

Overview

Search at the top (in every area, also during a call): one term finds mail, events (half a year back and ahead), contacts, tasks, notes, files (by name) and chats; a click or Enter jumps to the result. Ctrl+K (Cmd+K on a Mac) jumps into the field. On the Mail page, Enter without a selected result filters the mail list.
The overview gathers mailbox figures, appointments, latest emails, chats, tasks, My files, secure mail, what's new and news.
“New secure mail” at the top next to “New mail” opens a new secure message; without a key, the page first guides you through setting one up.
“Customise” turns on arranging: move by the handle at the top right, make widgets wider, narrower, taller or shorter at the edge and corner, hide them with the eye. “Widgets” shows them again or restores the default; “Done” ends arranging.
The layout is saved for your account and applies on every device and in the agent window. On narrow screens the widgets are stacked in the same order.

E-mail

Folders: right-clicking a folder opens a menu to create, rename and move folders.
Selecting several messages: Ctrl+click one by one, Shift+click a range, Ctrl+A all loaded ones, Esc clears the selection. The bar above the list acts on all selected messages.
Deleting moves messages to the trash. They are only deleted permanently from the trash and after a confirmation.
Attachments: via “Attach” or by dragging files into the compose window, up to 20 files and 20 MB in total per message.
Forwarding takes the attachments of the original message along; each can be removed before sending.
If something has already been typed or attached in the compose window, Esc, a click outside the window and “Discard” ask before anything is lost.
Bcc is still blocked for mailboxes on a connected mail server until it has been verified that recipients do not see the hidden addresses.
Rule from a message: right-click a message → “Create rule…” opens the rule editor, prefilled with sender and subject. This works in your own main mailbox; the rule applies to messages arriving afterwards.
Sending from the sarebamail mail server: every message you send from a mailbox on the sarebamail mail server – to the outside and also to other sarebamail addresses – is checked first by the spam and virus filter mailsecurity by sareba. Messages to sarebamail addresses therefore arrive after this check, usually within a few seconds. If mailsecurity by sareba rejects a message as spam, it is not delivered and you receive a non-delivery report.
Mail apps (IMAP and SMTP, Pro): for mailboxes on the sarebamail mail server, access for Thunderbird, Apple Mail, Outlook and phones is prepared – incoming via IMAP (mail.sarebamail.com, port 993, SSL/TLS), outgoing via SMTP (port 587 with STARTTLS or 465 with SSL/TLS); the user name is your address, the password an app password from Settings → Apps. Sending uses the same checks as here: only from your address or an alias, within your plan's limits and via mailsecurity by sareba. Deleted messages go to the trash; they are deleted for good only there and in drafts. Access is activated once the ports are set up; until then Settings → Apps says so.
mailsecurity by sareba (shield in the left bar): view, release or reject messages held by the spam filter. Currently for mailboxes on the sarebamail mail server.
Always allow or block senders (mailsecurity by sareba, mailboxes on the sarebamail mail server): in the list at the bottom of the page or on a held message with “Allow sender” or “Block sender”, for several via the selection. An address (name@company.example) takes precedence over a whole domain (company.example). Messages from blocked senders go to your junk folder – without filter rules, forwarding and out-of-office reply; nothing is deleted. Allowing releases held messages from this sender right away.

Secure mail

Secure mail has a tab of its own, separate from normal mail. There you set up your key once: it is created in your browser.
It is protected by a passkey (Windows Hello, Touch ID, phone), a passphrase of your own with at least 12 characters, or both. The passphrase is not your sign-in password and never leaves the browser.
You also get a recovery code. It is shown only once – write it down or print it. sarebamail cannot restore it.
The key stays unlocked in this browser – in all tabs and windows and after reloading – until you choose “Lock”, sign out or 12 hours have passed. During that time it is kept encrypted in the browser's storage (IndexedDB) with a browser key that scripts cannot read out; whoever takes over the browser during that time can read your secure messages. On another device you unlock with the passphrase or the code and can add a passkey there.
Under “Locks” you see what can open your key. The last passkey/passphrase lock and the last recovery code cannot be removed. Adding and removing works only with an unlocked key.
Organisation recovery key: Pro admins (for a single account you yourself) create it under “Secure mail”, whole or in three parts, of which two are enough. It is shown and downloaded only once; sarebamail stores only the public part with the admin's signature. All members see its fingerprint; if it changes, a notice appears. With “Check key” you test a stored key.
Messages: under “New message” to addresses with a key – your organisation or the exact address of another. Subject and text are encrypted in this browser, wrapped for every participant and for the recovery key of the organisations involved, and signed by the sender. When opening, the browser checks the signature; if it does not match, nothing is decrypted. Text is shown as text only.
Drafts: “Save as draft” while writing keeps recipients, subject and text under “Drafts” – encrypted in the browser for your own key, available on each of your devices where the key is unlocked. Saving again replaces the draft; after sending it is deleted. Attachments and recipients by link are chosen when sending. A draft for an earlier key can no longer be opened, only deleted.
Deleting removes the message from your mailbox; the other participants keep it until they delete it too. Secure messages do not expire. Your plan limits how many you send per month.
New device: “Unlock with another device” shows a code and a check value. On a device where the key is unlocked, enter the code under “Pair new device” and compare the check value – transfer only if it matches. The key goes encrypted to this device only; then best add a passkey there.
Lost all locks: “Lost all locks?” when unlocking sets up a new key and asks your organisation for recovery. The administrators confirm with the recovery key after checking with you; then your earlier messages are readable again (marked “recovered”). Without an organisation recovery key they stay unreadable.
Deputising: if you allow it under “Key, locks and recovery”, your organisation's administrators can open individual secure messages of yours. Every opening appears in your log; consent can be withdrawn at any time and then takes effect immediately.
Log: recovery keys, replaced keys, requests, recoveries, consents and openings are recorded in a log with a hash chain – every member sees what concerns them, the administrators see everything, with chain check and export.
Attachments: with “Attach files” when composing. They are encrypted in the browser in 4 MB blocks and only then uploaded; name and type are only in the encrypted text. Your plan's attachment limits apply (as for normal mail). sarebamail deletes aborted uploads after 24 hours.
Recipients without a key: tick “Invite recipients without a key via link”, choose a passphrase (at least 12 characters, a strong one is suggested) and the validity. After sending you get a link per recipient; send it yourself (e.g. by normal mail) and tell them the passphrase another way. The recipient opens the message in the browser, without an account. Before every attempt their browser does a short calculation; after 5 wrong passphrases the link is locked for an hour, after 10 for good. Under “Sent” you see whether it was opened.

My files and Office

“My files” is your storage at sarebamail (Pro). The side panel shows how much is used and how much your quota allows; the limit applies to your whole organisation. The overview shows the same, plus your recently modified files.
Uploading through the page works for Office files (DOCX, ODT, DOC, RTF, XLSX, ODS, XLS, CSV, PPTX, ODP, PPT), text files (TXT, MD, JSON, XML, YAML, LOG, INI), PDF and images (PNG, JPG, GIF, WebP) – everything that can be opened here. sarebamail rejects other files and names them. The drive (WebDAV) and “Save attachment” from an email still accept any file.
“New” creates a text document, a spreadsheet or a presentation; clicking an Office file opens it in the editor. The page is always light like paper, whatever the theme. Saving keeps the original format, and every save is a new version. Text files (TXT, Markdown, JSON …) open in the text editor – on every plan, keeping encoding and line endings. Files sarebamail does not know ask “Open with” on click: text editor, document, spreadsheet, presentation or download; document, spreadsheet and presentation create a new file next to it, the original stays. Right-click → “Open with …” also works for text files.
Clicking a PDF or image opens the preview. It is created in your browser; the server only delivers files as downloads.
Sharing: with members of your organisation to view or edit, or as an external link with expiry, optional password and a maximum number of downloads (Pro).
“Send by email” (on the file, in the preview and in the editor) opens a new email with the file attached – to recipients inside or outside your organisation. From the editor, the saved version is sent.
Deleted items stay in the trash until you delete them for good. Earlier versions are under “⋯ → Versions”.
Editing at the same time: if a file you have open in the browser is saved elsewhere in the meantime (drive on a PC, another window, another person), the editor shows a notice; a text document without your own changes updates by itself. When saving, text files are merged line by line – including what the PC saves through the drive, as long as it opened the file through the drive before. If both changed the same line, both versions are marked in the text (“<<<<<<< Your change” … “>>>>>>> saved elsewhere”): clean up and save, or “Save only my version”. Documents, spreadsheets and presentations ask: save anyway, save as copy or reload. Every overwritten version stays under “Versions” and can be restored.
Editing together live: if several people have the same text file or document open in the browser (also the same person in two windows or in the desktop app), everyone sees the others' changes right away. The top shows “Together with:” and who is there; in documents a coloured cursor with a name shows where someone is writing. “Save” creates a new version for everyone; the others see “… saved”. Undo only applies to your own steps. Spreadsheets and presentations are not live (yet) – there the editor asks when saving. What a PC saves through the drive appears as a notice; “Take over changes” merges it for everyone and saves.

Calendar, contacts, tasks, notes

Events, contacts, tasks and notes come from the mail server and can be created, edited and deleted here.
Changes are also visible in other programs connected to the same mailbox.
Recurring appointments: in the form under “Repeat” choose daily, weekly, monthly or yearly, plus the interval (every 1, 2, 3 …) and whether the series ends. Weekly uses the weekday of the start, monthly the same day of the month. When editing or deleting a recurring appointment, choose “Only this appointment”, “This and all following” or “All appointments in the series”.
Own calendar: mailboxes on the sarebamail mail server now have a calendar of their own (“My calendar”) with series (daily, weekly, monthly, yearly; change or delete only this one, this and following, or all) and reminders. A reminder appears as a notice with a tone in every open sarebamail window and in the agent – there only with the time, without the title. Mailboxes on a connected mail server keep its calendar.
Own contacts: mailboxes on the sarebamail mail server have an address book of their own under “Contacts” (“My contacts”) with names, company, addresses, phone numbers and a note. When composing, sarebamail suggests addresses from it and the members of your organisation. There are also own tasks (due date, priority, done) and notes (with colour).
Calendar and contacts in other apps: Settings → Apps lists server, addresses and user name for the calendar (CalDAV) and contacts (CardDAV); there you create an app password per device (it also works for the drive). iPhone, iPad and Mac find the addresses from the server on their own, on Android it works with an app such as DAVx⁵, in Thunderbird with the addresses. Events (not tasks) and contacts are synchronised; recurrences daily, weekly on the same weekday, monthly on the same day and yearly – a recurrence such as “every Monday and Wednesday” is rejected by sarebamail instead of being changed. A single occurrence moved in a series shows up here as an appointment of its own. Anything else an app sends (attendees, further reminders, photos, birthdays) is kept and comes back on the next sync. Mailboxes on a connected mail server use its CalDAV and CardDAV.
Right-click in the calendar: on an event – Open, Edit, Duplicate, “Copy to calendar …”, “Move to calendar …” (single events only) and Delete; title, location, description and time are copied, without attendees and recurrence. On a free time slot – “New event here” and “Plan meeting” at that time. On a calendar on the left – show only this one or all, new event in it, Share.
Share calendar and address book (mailboxes on the sarebamail mail server): right-click “My calendar” or “My contacts” → “Share …” or Settings → Sharing. You can share with any address on the sarebamail mail server, levels: Free/busy (busy times only, calendar only), Read, Edit, Manage. Nobody but you sees private events. The person receives a short message in their mailbox and then sees “Calendar of …” or “Address book of …” in their list. In calendar and address book programs (CalDAV, CardDAV), shared calendars and address books appear on their own as additional calendars or address books, with the same levels; your reminders are not passed on, and with “Read” sarebamail refuses changes made in the program.

Settings

Out of office: automatic reply, optionally for a period of time. For mailboxes on the sarebamail mail server, sarebamail replies at most once per sender in four days and never to mailing lists, bulk mail, automatic messages or spam; the reply goes through the spam filter like any mail.
Signatures: per mailbox; they are inserted when composing.
Filter rules run on the mail server for every incoming message, from top to bottom. Conditions: sender, recipient, To, Cc, subject, size, attachment, spam or all messages. Actions: move to folder, mark as read, forward, send copy, reply automatically, stop processing more rules.
“Forward” in a rule sends the message on without keeping it in the mailbox; for a copy there is “Send copy to”. “Mark as read” runs before moving, “Stop processing more rules” last.
sarebamail does not offer discarding messages as a rule – to delete, a rule moves messages to the trash. Rules created on the mail server with other parts can be switched on or off, moved and deleted here, but not edited.
Delegation and sharing: give other people access to individual folders or the mailbox.
Plan: shows the limits of your account – such as whether attachments are allowed, how many recipients per message and how many messages per day – and how many you have sent today. The operator sets the values.
Password (sarebamail mailboxes only): under Settings → Password, at least 12 characters. Afterwards you are signed out on all other devices.
Aliases (sarebamail mailboxes only, Pro plan): under Settings → Aliases you create additional addresses on your mailbox's domain. They receive into the same inbox and can be chosen under “From” when composing. If your plan falls below the number of your aliases, messages to them still arrive; sending from them and creating new ones is then no longer possible, deleting is always possible.
Pro Admin (Pro plan): “Pro Admin” is at the bottom of the left bar and in the user menu. There you name your organisation, see booked and used Pro seats, add seats and appoint further Pro admins. Every user who can sign in takes one seat; at least one Pro admin always remains.
Extend (Pro): under “Pro Admin → Extend”, Pro admins book add-on packages offered by the operator – for example a larger mailbox, more space in My files or a longer spam quarantine. “+” applies immediately; “−” only works as long as the organisation does not then use more than allowed. Every booking is logged with time and price and billed together with the Pro seats.
Filter rules exist for mailboxes on a connected mail server and on the sarebamail mail server. On the sarebamail mail server: move to folder, mark as read, stop processing rules; conditions on sender, recipient (also via an alias or as Bcc), To, Cc, subject, size and attachment. If a target folder has been deleted, the message goes to the inbox. Forwarding to outside addresses follows with Pro.
Own domain (Pro): in the “Pro Admin” tab you add your domain and create the TXT record shown at your DNS provider; “Check now” verifies it. Then the DNS assistant shows the remaining records with target and actual values (MX, SPF, DKIM, DMARC and the confirmation at the spam filter) – the MX last. As long as a domain is not verified, it has no effect anywhere. It can only be removed without mailboxes.
Users of the own domain (Pro): under “Pro Admin → Users” you add a user with address, name and password on a verified domain; each takes a Pro seat. The password is shown only once – pass it on securely. At the first sign-in the user sets their own; nothing else works before that. “Block” ends all of the user’s sessions at once, their data stays; “Set new password” helps if they have forgotten it.
Forwarding (Settings → Forwarding): forward incoming messages to up to five addresses, optionally keeping a copy in your mailbox. To sarebamail mailboxes in every plan, to other providers with Pro. The spam filter checks every forwarded message; your mailbox is the envelope sender so the check at the target (SPF) passes. If forwarding fails, the message is in your inbox, with a report. A message that would loop through several mailboxes stays in the mailbox on its second pass. In a Pro organisation, Pro admins can set forwarding for members and shared mailboxes (“Pro Admin → Users → Forwarding”); you then see here who last changed it.
Mailing lists (Pro): under “Pro Admin → Mailing lists” you add an address on your verified domain and enter the members (also addresses at other providers, up to 500). Choose who may send: members only, your organisation or everyone. Each member gets every message individually with their own unsubscribe link; mail programs offer an “Unsubscribe” button for it. Bounces go to the person who created the list. Under “Edit” you choose moderation: messages from senders who may not post wait for approval instead of being rejected – or every message waits. Pro admins see waiting messages via the button on the list (text only) and approve or reject them; the sender is not notified, and they do not expire. When the first one arrives, a short notice lands in the mailbox of the person who created the list. “Rewrite sender”: if a sender's domain requires DMARC “reject” or “quarantine”, the list sends the message as “Name via List” with the list address as sender, otherwise large providers reject it; replies still go to the sender. With “Archive”, every distributed message is kept once, encrypted: members with a sarebamail mailbox read it under Settings → Mailing lists (text only), Pro admins via “Archive” on the list, where they delete single messages or the whole archive by hand. The archive uses storage in the mailbox of the person who created the list; when it is full, messages are still sent but no longer archived. A list with an archive can only be deleted after emptying it.
Mail security (shield icon in the left column): here you see what the spam filter has held back for your addresses (mailbox and aliases), read a safe text version and release or reject a message. Both apply only to that message. Pro admins switch to “Organisation” to see mail to all addresses of the organisation. “My spam protection” at the top says how many days the quarantine covers (Free 14, Pro 90 days); older messages are hidden. The “Spam” tile on the overview shows how many messages are held right now (refreshed at most every 5 minutes). At the top of Mail security you see how much the spam filter held, released, rejected or let expire within your period, the most frequent senders and domains among them, and how many of your messages sent in the last 30 days it rejected (recounted at most every 15 minutes).
Aliases for members (Pro): under “Pro Admin → Users”, “Aliases” opens the list of further addresses for each member, where you add or remove them. The plan’s alias limit per mailbox applies.
Filter rules for mailboxes on the sarebamail mail server can also redirect a message (“forward”, then it is not kept in the mailbox) or send a copy to an address. To sarebamail addresses in every plan, outside with Pro. If delivery fails, the message still lands in the inbox.
Shared mailboxes (Pro): under “Pro Admin → Shared mailboxes” you add an address such as info@ and give members reading and sending with “Access”. It appears for them in Mail as another account. It takes no Pro seat, and nobody signs in with it. If you remove access, the account disappears for the member. With “read only” a member sees the messages and downloads attachments but cannot send, delete, move or flag; the read status stays as it is for everyone. “Forwarding” on the shared mailbox forwards its mail like Settings → Forwarding.
My files (Pro): “Files” in the left bar. Create folders, upload files (“Upload” or drag and drop, also large files), download, rename, move. Deleted items stay in the trash until you delete them permanently or your plan's period expires; “Restore” brings back a folder with everything in it. The storage applies to the whole organisation (per booked Pro seat); if it is full or your plan includes none, you cannot upload any more but can still download and delete. Files are stored encrypted, but not end-to-end encrypted, and are not scanned for viruses. With mail: the button next to an attachment puts it into “My files” (top level, up to 100 MB); when composing, “From My files” attaches stored files. Sharing: the people icon on a folder or file shares it with members of your organisation, with “Read” (view, download) or “Edit” (also upload, create folders, rename, move and delete – inside the shared folder, not the folder itself). For the others it appears under “Shared with me”; it stays with you, deleted items go to your trash, uploads count towards your storage. “Stop sharing” withdraws the share, “Remove” under “Shared with me” hides it for the recipient. Versions: if you upload a file with a name that already exists in the folder, sarebamail asks whether it should become a new version; the clock icon on a file shows all versions with time and who uploaded them. Earlier versions can be downloaded and restored (the current one becomes a version itself); they count towards storage until the owner deletes them – none is deleted automatically. As a drive: “As a drive” shows the address and user name for Explorer, Finder or another WebDAV program; you sign in with an app password per device, shown only once and revocable individually – never with your password. Office (Pro): “New document” creates a text document, the pen icon on a Word file (DOCX) opens it in the browser. Saving creates a new version of the same file, the original stays under “Versions”. The editor handles headings, emphasis, links, lists, quotes, tables and alignment; images, headers and footers, comments and elaborate layout are lost when opening – a notice says so. “New spreadsheet” creates a spreadsheet, and the pen icon on an Excel file (XLSX) opens it the same way: formulas, several sheets, number formats, fonts, colours, alignment, merged cells, column widths and row heights are kept; images, charts, conditional formatting, comments and macros are not – a notice says so here too. “New presentation” creates a presentation, and the pen icon on a PowerPoint file (PPTX) opens it: add, move, duplicate and delete slides, place and resize text boxes and images (PNG, JPEG, GIF up to 5 MB) freely, font, colour, alignment, bullets and a background per slide; “Present” shows the slides full screen. Formatting applies per text box. Charts, tables, shapes, groups, animations, notes and graphics from the slide template are not kept – a notice says so here too. Conversion and calculation happen in the browser, not on the server. Other formats – ODT, ODS, ODP, DOC, XLS, PPT, RTF, CSV – also open with the pen icon: sarebamail converts them on its own server with LibreOffice to DOCX, XLSX or PPTX and back when you save; formatting may change, the previous version is kept. “As PDF” downloads the current state as a PDF. For converting, the file goes briefly to a separate service without any connection to the outside and is deleted there afterwards. Via the drive a file of up to 32 MB per transfer works at the moment; what others share with you is there in the folder “Mit mir geteilt”, with the permissions of the share. Link for outsiders (Pro): in the sharing area of a file, “Create link” creates a link for people outside your organisation – valid 1 to 30 days, optionally with a password and a maximum number of downloads. The link is shown only once; afterwards you see expiry and downloads and can revoke it. The recipient only sees the file's name, size and expiry. A folder can be shared the same way: the recipient gets it as a ZIP with everything in it (without the trash); without a password they see the file names beforehand.
Report a problem: the bug icon at the top right or “Report a problem …” in the user menu. You see this browser’s error log exactly as it is sent to the sarebamail team and can describe what happened; nothing is sent until you click “Send”. If a page crashes, it offers the same button. In the mobile app: More → Report a problem.
Backup: Settings → Backup downloads the state of your account as a file – emails with folders, filter rules, forwarding, out-of-office, sender lists and aliases, calendar, contacts, tasks, notes, your files with earlier versions and the trash, chats, secure mail (stays encrypted) and your settings. By default a password of your own (at least 10 characters) encrypts the file; sarebamail does not store it and cannot recover it. Downloading works on every plan and even with full storage.
Restore: in the same tab, choose a backup file, enter the password, “Check”. The preview shows per area what is in the backup, what is missing today and what exists additionally, plus the space needed. Per area you choose: Add (only create what is missing, change nothing existing), Reset (state of the backup; additional items go to the trash, calendar and contacts are removed – sarebamail first backs up the current state for download) or Skip. Chats go into your chat archive (Chat → “Archive”), only for you and read only, with search; ongoing conversations stay untouched. If storage is not sufficient, the area cannot be restored (full storage = read only) – the notice leads to expanding it.
Trash and earlier versions in the backup: when restoring, missing files go back into the trash – into their folder and with the original deletion time, so items deleted together are restored together – and missing versions go back under “Versions” of their file, next to the current content. Both are only added, also when resetting: what is in the trash today or exists as a version stays. Both count towards storage.
Automatic backup (Pro): set up under Settings → Backup – backup password (at least 10 characters, cannot be recovered), daily or weekly, how many to keep. Backups are stored encrypted in the “Backups” folder of “My files” and count towards storage; sarebamail removes the oldest beyond the chosen number, never other files. If storage is not sufficient, no backup is created (full storage = read only) – a red notice then shows how much is needed and free, with “Expand storage”. “Back up now” backs up right away; “Restore …” next to a stored backup restores it with the backup password. Backups never contain earlier backups.
Organisation backup (Pro Admin): under “Pro Admin → Organisation backup” Pro admins download the state of all members and shared mailboxes in one file (default: encrypted with a password). To restore, upload the file below, check it with the password and choose a member – then, as for your own account, add, reset or skip per area (chats go into the member’s chat archive). Restoring only goes into accounts that still exist today. Every member sees in their own sign-in log that their account was backed up or restored. An organisation backup cannot be restored under Settings → Backup.
Backup by sareba (package): bookable under “Pro Admin → Expand”. Backups are then kept outside your storage in sareba’s backup box and do not count towards “My files”; the booked package sets the space. Members choose “At sareba” under Settings → Backup → Automatic backup → “Where”; under “Pro Admin → Organisation backup” the Pro admin can also set up the automatic backup of the whole organisation (its own organisation password). If the space is not sufficient, no backup is created – a red notice shows the numbers. Restore and remove directly from the list; existing backups stay readable after cancelling the package.
Backup with a connected mail server: if your mailbox is there, sarebamail backs up messages (all folders, with read/flagged and arrival date), appointments, contacts, tasks and notes from there – signed in with the password stored in sarebamail; if none is stored, sign in again once. Backing up changes nothing on the server. Restoring only offers “Add”: missing items are created (messages by their ID, appointments by title and start), nothing twice, nothing deleted. Attendees and “private” of appointments are not kept.
Not enough space for the automatic backup: in addition to the red notice, an email with the numbers is sent – to you, or for the organisation backup to all Pro admins. At the first failure and then at most once a week; after the next successful backup it starts over. The operator adjusts the email text under Administration → E-mail.
Secure mail in the backup: messages and their attachments go into the file encrypted, as they are stored – sarebamail cannot read them. When restoring, sarebamail checks every attachment against the signed header of its message; an altered attachment is not restored.
Account: the list of people blocked in the chat and “Delete account”. Anyone alone in their organisation (every self-registered account) deletes their account themselves; the owner of a Pro organisation deletes the whole organisation (type its name to confirm); a Pro admin deletes members under Pro Admin → Users. The operator deletes accounts on a connected mail server on request.
Deletion happens after 30 days. Until then the account is locked (including the desktop app, mobile app and mail programs), mail keeps arriving, and after signing in you cancel the deletion with one click. Every affected account receives an e-mail about it.

Chat

One-to-one and group conversations, teams with channels and your own folders for sorting.
People in your organisation are listed. People from other organisations are found by the exact address they sign in to sarebamail with – a mailbox alias is not enough.
Clicking a person opens their contact card with message, call, video and the call history.
A conversation can be opened in its own window via the window icon.
Search covers the last 500 messages of a conversation.
The overview refreshes itself while the window is visible: chats and online status every 10 seconds, mail counts, appointments and tasks every minute, headlines every ten minutes.
Files: with the paper clip next to the input field, by dragging into the conversation or with Ctrl+V (such as a screenshot) you add one or more files – they appear above the input field, images with a preview, each removable with ×. Add a text if you like; “Send” sends the files first, then the text.
Areas: the line between the conversation list and the chat (and during a call in the “Chat and calls” app between call and chat) can be dragged with the mouse; the width is remembered in this browser, double-clicking the line resets it.
Delivered and read: under your messages one tick means “sent”, two ticks “delivered” (a device of the recipient fetched it) and two coloured ticks “read”; in groups your last message shows “Read by 2 of 4”. Turn read receipts off in your status menu – then others do not see what you have read, and you do not see it for them either.
Disappearing messages (Pro): turn them on with the clock in the header of a conversation (1 hour, 1 day, 1 week, 30 days). New messages, files and call entries then disappear for everyone after that time – on the server and on the devices running sarebamail. Anything written before stays. All participants see a bar saying it is on; anyone who sees a message can still copy or photograph it. In channels team owners switch it.
Emojis: the smiley button next to the input opens the picker with search (German or English) and recently used ones. Emojis are shown in your device’s font.
Reactions: hover over a message and pick an emoji – one reaction per person, a new one replaces the old, a second click removes it. The tooltip shows who reacted.
GIFs: the GIF button searches openly licensed, animated GIFs on Wikimedia Commons (CC0, public domain, CC BY, CC BY-SA). Title, author and license appear below each GIF. Commons is mostly labelled in English – English terms find more. Send your own GIFs and images as a file; once they are on the device, the history shows them directly.
Links in messages are clickable and open in a new tab, without the target page learning which chat the click came from.
End-to-end: choose “End-to-end encrypted” when starting – possible if everyone involved has a secure mail key. The conversation shows a lock and sits next to an existing one with the same person. To read and write, unlock your key at the top of the history (passkey, passphrase or recovery code); without it you see “Encrypted – unlock to read”. Every message is signed by its sender; “Cannot be verified” means the signature does not match. Search only covers the messages loaded in this browser. If someone replaces their key, another member’s browser adds it to the conversation the next time it is opened. Not end-to-end: group name, reactions, name and size of announced files, who writes when; GIFs and guests are not available there.
Edit and delete: right-click your own message. Texts can be edited (they are then marked “edited”), texts, GIFs and files can be deleted – “Message deleted” takes their place, reactions are removed, files also disappear from the others’ devices.
Report and block: right-click a conversation or use the menu at the top of the conversation → “Report …” or “Block …”. People you block no longer find you in the chat and cannot start a conversation or group with you; in a one-to-one conversation neither of you writes or calls any more. Groups stay as they are. Undo under Settings → Account.
A report goes to the sarebamail operators, optionally blocking at the same time. For ordinary conversations, the reported person's latest messages from that conversation go with it; sarebamail cannot read end-to-end conversations – there you paste in what the operators should see.

Calls and video

Video and audio go directly between the browsers where possible. If that does not work, a relay forwards the still encrypted data. The call window shows which path is used.
How many people can join a call depends on the plan of whoever starts the call or meeting (between 2 and 8, guests via link count too); the operator sets the numbers per plan in the administration.
You can compare the check code in the call window with the other person; if it differs, it is better to hang up.
With a direct connection, the participants see each other's IP addresses.
A call opens in its own window. If the browser blocks pop-ups, it runs in the page.
Status like in Teams: green available, yellow away or be right back, red busy (also automatically during a call and during a meeting in your own calendar), red with a bar “Do not disturb”, grey offline with “for …”. You count as away after 5 minutes without mouse or keyboard – if the agent is running, any input on the computer counts, also in other programs (Windows, macOS, Linux with GNOME); otherwise only input in a sarebamail window. Choose your own status via your picture at the top right (in the “Chat and calls” app via your name), plus a status message and when both are reset. “Do not disturb”: nothing rings and the agent does not report messages and mails; “Appear offline”: others see you as offline. Only people who are online can be called. The status is visible to people from your conversations and your organisation; “offline since” can be switched off for others in the same menu, Pro admins of your organisation and the operators still see it. With away, busy and the other statuses “since …” appears as well – by the same rules as “offline since”.
Every call appears in the conversation and under “Calls”: missed, declined, not answered or with its duration. A missed call counts as unread.
Video calls run at up to 720p, in one-to-one calls up to 1080p, depending on camera and connection. The button with the bar icon shows resolution, frame rate and bitrate in both directions and what is currently limiting the picture.
If a call rings in several windows and in the sarebamail agent, all of them stop ringing as soon as you accept or decline in one place.
If another application is using the camera (such as Teams, Zoom or OBS), a video call continues without your own picture; you still see and hear the others. If the microphone is in use or missing, sarebamail tells you – for the caller it is then a missed call, not a declined one.
Choose the ringtone under Settings → Calls: ringing, gentle tones and public-domain melodies, each with preview and all at the same volume. It applies in the browser and in the sarebamail agent.
When calling you hear the ringback tone until the other person answers or declines.
Pictures in a call: clicking shows a picture large and moves the others into a strip (“Show all” goes back); a double-click switches to full screen. Make your own picture larger or smaller with the magnifiers that appear on hover.
Screen sharing: the button with the screen icon opens the system picker – entire screen (also with several), a single window or a tab. Stop with the same button or the browser’s “Stop sharing”. People who join later first see your camera.
Devices: the gear button in a call chooses the microphone, the speaker (where the browser can choose the sound output) and, in a video call, the camera – without interrupting the call. Permanently under Settings → Calls, with a test tone and a microphone test; the choice applies in this browser or this desktop app. If the chosen microphone disappears (headphones off), the call continues with the default microphone. Bluetooth headphones such as AirPods switch to a lower sound quality as soon as their microphone is used – the sound is then often choppy. Better: sound through the headphones, the computer’s microphone for talking; sarebamail points this out during the call.
Background noise: the button with the microphone wave icon turns suppression off and on during a call. When off, the signal goes out unfiltered – for music, for example. The browser remembers the choice.
Full screen: the button at the top right of the call shows the whole call full screen, Esc ends it. In the agent app on the Mac the window’s green button also works.
Chat during a call: the speech-bubble button in the call opens the conversation's history next to it (below it in narrow windows). Messages go to all members of the conversation and stay in the chat afterwards.
Screen sharing: your camera image stays visible. When someone else shares, you see their screen large and everyone's camera images in a strip next to it; clicking a camera image enlarges it.
Interruption: if the connection to a participant drops, “Connection interrupted – reconnecting …” appears on their image; sarebamail rebuilds the connection up to three times before it counts as failed. If your own internet connection is missing or the server does not respond, this is shown at the top of the call; existing connections keep running.
“End-to-end encrypted” appears on an image when it has been measured for that connection that audio and video are encrypted with DTLS-SRTP – only the devices involved know the keys, also via the relay. Compare the check code to make sure nobody sits in between.
Background (Pro): in a video call the background button blurs your background slightly or strongly or replaces it with a built-in or your own image. The image is computed on your device before it is sent; your choice also applies to the next calls. On slower devices the video may stutter – then turn the effect off.
Meetings: in chat via “New” → “Plan meeting” or in the calendar via “New meeting” – with title, time and duration, in an own group or a team channel, plus external email addresses. The operator sets how many people can take part at most (default four), because calls run directly between the devices. Five minutes before, a reminder with a signal tone and “Join” arrives; nobody gets rung. From 15 minutes before the start, “Join” takes you into the meeting call – if it is already running, you join it. Accept, maybe or decline in the bar above the chat; whoever created the meeting can change or cancel it. Participants receive an invitation with a calendar file (.ics): mailboxes on the sarebamail mail server directly into the mailbox, everyone else by email as soon as sending is set up.
Guests via link: whoever created a meeting copies the “guest link” in the bar above the chat (or in the calendar); external invitees receive it with the invitation. Guests need no account: they enter a name and wait until you admit them – a card with “Admit” and “Decline” appears at the top of the window for this, also in the call window. Admitted guests join the meeting’s call as soon as it is running; in the call window they have the meeting chat, but only with what was written after they were admitted. In the history their messages appear as “Name (guest)”. They count towards the maximum per call and are marked as guests on their tile.
Reactions and raising your hand in a call: the 👏 button sends everyone a reaction (clap, thumbs up, heart …) that briefly appears over the video, with a soft tone. With ✋ you ask to speak: the hand stays in the list at the top left until you lower it or someone else – such as the presenter – lowers it; raising it plays a clearer tone – at most once every 8 seconds per person, even if someone raises their hand several times in a row. None of this is stored.
Call duration: the top of the call shows how long the call has been running since connecting.
Muting others: via ⋮ on a person’s video you mute them “for me” – only you no longer hear them – or turn off their microphone. They then see who turned it off and can turn it back on themselves. Guests via link cannot mute anyone.
Sounds for reactions and raised hands: the bell button at the top of the call turns them off and on; the browser remembers the choice.
View: under “View” at the top of the call choose Automatic (gallery; stage when someone shares or something is pinned), Gallery (all the same size), Stage (one or more tiles large, the others at the edge) or Arrange freely (drag tiles, make them wider, taller, larger or smaller). Every camera and every shared screen is its own tile; if several people share, choose what is shown large. Via ⋮ on a tile: show large (pin, several possible), hide (audio keeps playing, show again at the top) or detach into its own window – “Dock” brings it back; if pop-ups are blocked, as picture-in-picture. All of this only affects your window.
Zooming a shared screen: mouse wheel or two fingers zoom around the point you show, dragging moves, the buttons at the top right set the size or reset to 100 %. This only changes your view.
Call in a separate window: at the top of the call, the window button (“In a separate window”) moves the conversation into its own window without interrupting the connection. You keep working in the main window (mail, calendar, search). “Back to the main window” or closing that window brings the call back; otherwise, after switching areas it is shown small at the bottom right.
Reactions during a call: at most three in five seconds per person (more do not reach the others), and their sound at most every ten seconds.

Agent and notifications

The sarebamail agent shows new mail, chat messages and calls, even without an open browser window – on Windows in the notification area, on macOS in the menu bar, on Linux in the desktop panel. Download it via “Download agent” in the user menu or on the /download page; the steps for each system are on /einrichtung.
On first start the agent opens the setup assistant in your browser and shows a code; you confirm it while signed in. If the browser did not open, choose “Pair…” in the icon menu. The agent does not know your password; it gets its own access token that may only fetch notifications.
Notifications name the sender only – never subject, text or group names. Spam is not reported.
For mail notifications, sarebamail signs in to the mail server itself with your stored password while the agent is running and looks into your inboxes once a minute. This session appears in your session list on the mail server and is signed out at the latest 20 minutes after the agent stops.
If you changed your password on the mail server, the agent shows “Please sign in once”. After signing in in the browser, it continues.
Under Settings → Devices you see all paired devices with the time of their last request and can disconnect each one.
The access token is stored on the computer: on Windows encrypted for your Windows account, on macOS in the keychain, on Linux in the desktop keyring (Secret Service) or, if there is none, in a file only your user account can read.
Updates: the agent looks for a new version every hour and right after waking from sleep. On Windows and macOS it updates itself and checks sareba’s signature first; if that fails, a notification points to the download page. On Linux a timer from the package (systemd) installs new versions itself every hour – only the agent’s package, checked against sareba’s signature – and the running agent then restarts with the new version, also after a manual update. While a call is running, the update and restart wait until it is over.
A call shows up in the agent with the caller’s name and the buttons “Accept” (green) and “Decline” (red); on the Mac as its own window at the top right, even if notifications are off. “Accept” opens the call in the browser, “Decline” declines it.
Missed calls: if nobody answers, the agent shows “Missed call from …” and a green number appears on the left of its icon. It disappears as soon as you open sarebamail from the agent (menu “Open sarebamail” or the missed-calls entry). Calls you answered or declined elsewhere do not count.
The “Choose ringtone…” menu item opens Settings → Calls in the browser.
sarebamail in the agent: clicking the icon or the “Open sarebamail…” menu item opens the whole app in a window of its own – overview, mail, secure mail, calendar, contacts, tasks, notes, chat, files and mailsecurity by sareba, with the same bar as in the browser (Windows: Microsoft Edge WebView2, macOS and Linux: WebKit). The system asks once for camera and microphone on the first call. Links to other sites open in the default browser. If the window is already open, the click only brings it to the front – a running call continues. If WebKitGTK is missing on Linux or cannot do calls, the browser opens instead. “Open in browser” in the menu opens sarebamail in the browser as before.
In the window you are signed in automatically while the device is paired. For this the agent fetches a one-time code each time, valid for 60 seconds and usable only once. Every such sign-in is recorded with the device name in the sign-in log. Once you unpair the device, automatic sign-in ends too. Clicking a notification about chat, mail, secure mail or an appointment opens the right place in the window; if a call is running there, the browser opens instead so the call is not interrupted.
In the window's chat a call runs in the same window: large on the left, with the conversation’s chat to its right; the list of conversations steps aside meanwhile, and a button above the call shows it again. In narrow windows the call sits at the top with the chat below; there the button at the top right of the call expands it to full height and back. “Accept” in the agent’s call notification also answers in the window.
Numbers on the icon: a green circle on the left counts missed calls, a red one on the right unread messages, both with a white number – on the small icon in the notification area or menu bar and on the app icon: on Windows on the agent window's taskbar button (plus a red dot during a call, like the “in a call” status), on macOS in the Dock while the window is open, on Linux on the window icon; the launcher (Ubuntu Dock, Dash to Dock, Plank, KDE) can show only one number and shows the total. Next to “Connected”, the menu shows the address the agent is paired with. When a call rings, the button flashes or the Dock bounces. Clicking a chat notification as well as “Reply” and “Call back” open the conversation in the agent window.
Windows: start the agent again via “sarebamail Agent” in the Start menu or search. Better delete older downloaded copies (for example in the Downloads folder) – a very old copy would otherwise replace the current version.
Send problem report: in the menu at the agent icon, “Send problem report…” sends the end of the agent log (states, status codes, error types – no names, identifiers or content) to the sarebamail team. A short confirmation appears afterwards.
Test ringtone: in the menu at the agent icon, “Test ringtone” plays the ringtone for five seconds on the default sound output. If you hear nothing, check the output device and, on Windows, “Do not disturb” and the setting that lowers other sounds during calls (for example in Teams).

What is stored

E-mails, events, contacts, tasks and notes are kept on the mail server. sarebamail displays them and does not keep its own copy of this content in its database.
Stored encrypted: your mail server password and your mail server session, chat messages and the names of groups, teams, channels and chat folders. This is encryption at rest, not end-to-end encryption: the service processes chat messages in plain text for delivery.
End-to-end chats: only ciphertexts created by the browsers of those involved (also stored encrypted like every chat message), the sender’s signature, the header signed by the creator listing the members, and the conversation key wrapped for the members’ keys and their organisations’ recovery keys – not for sarebamail. Group name, reactions and announced file names are not end-to-end there.
Added sarebamail mailboxes: no password, only a check value derived from the stored password hash of the mailbox. It shows whether the password has changed since; the password cannot be derived from it. Adding the mailbox appears in its sign-in log, with the address of whoever added it.
Sending from a sarebamail mailbox: the IP address you send from stays with the message in the outbox until it is delivered and goes to mailsecurity by sareba with the check – so mailsecurity by sareba checks where your message comes from, not just our server. Afterwards sarebamail deletes it; mailsecurity by sareba keeps its check log for 90 days.
Stored unencrypted: who wrote in which conversation and when, the call log (time, duration, participants, outcome), signatures, sign-ins and sign-outs with IP address and browser identifier, and an event log per mailbox (such as “message sent” with the number of recipients – without addresses, subject or content).
Paired devices: name, time of pairing and of the last request; the agent’s access token only as a checksum. Pending pairing codes are deleted after one hour at most. What the agent has already been notified of is kept in memory only. The mobile app counts as a device with its kind (Android, iPhone); for an iPhone also, encrypted, the identifier under which Apple wakes the phone (APNs token). The wake-up itself is empty – no sender, no content; Apple only sees that and when a phone is woken.
System emails (welcome, new device, notice to the operators): a send log with time, template, recipient address and the template subject, the last 1000 entries. The mail server password for sending is stored encrypted.
Views of the public pages (home, download, updates, help, sign-in): page, source (such as “google.at”), kind of source and device type – without IP address, without cookies and without browser identifier, for 90 days. Anyone setting “Do Not Track” or GPC is not counted.
Credentials for Google Search Console, Bing and Yandex Webmaster used for search statistics are stored encrypted; only totals for queries and pages are fetched.
The plan per organisation and values that differ from it; per user a counter of messages sent today (only the number, 90 days). Operator announcements with title, text and period. Headlines are not stored, only kept in memory for 15 minutes.
The chosen ringtone (one row per user).
Mailboxes on the sarebamail mail server: messages stored encrypted (header and content separately), not end-to-end. Not encrypted: size, time of arrival, folder and flags such as read or flagged. In the trash, your plan’s period applies from the time of deletion; after that the message is deleted for good.
Not stored: video and audio of calls and the connection data of call setup. Whether someone is online, away, in a call or in a meeting is worked out by the server in memory only; from the calendar only the end of a running meeting is sent for this, never its subject, place or attendees.
Calendar and contacts from apps (CalDAV, CardDAV): besides title, times, place, names and addresses, sarebamail stores the original last sent by the app for an appointment or contact, encrypted – so that attendees, photos and other details sarebamail does not show are not lost when syncing. Only the file name given by the app (usually a random identifier) remains in plain text. Both are deleted together with the appointment or contact. Sign-ins by apps appear in the sign-in log without the password.
Mail apps (IMAP, SMTP): for this sarebamail stores only one marker per message (marked for deletion); contents stay encrypted and are decrypted only when your app fetches or searches a message. Sign-ins by apps appear in the sign-in log at most once per hour and app password, without the password; failed attempts every time.
Attachments you send are kept in memory only while sending and then go to the mail server.
Agent window: the sign-in, cookies and page cache are stored on your device in the agent’s program folder (Windows: %LOCALAPPDATA%\sarebamail-agent\webansicht, macOS: WebKit’s data store for the agent) – as with a browser, not with us.
Sending from a sarebamail mailbox: until a message is delivered to other servers (at most 5 days) it lies encrypted in the queue; afterwards its content is deleted there. Address, time and result of the delivery are kept for 30 days as a log. The copy in “Sent” stays as long as you keep it.
Self-registration: the contact address is stored encrypted (with key version) and additionally as a keyed hash so the same address cannot be used any number of times. Also stored are the times of creation, confirmation, approval and blocking. The IP address is not stored, only a keyed hash of it for the limit per connection, which is deleted after at most 25 hours. Links from system mails exist only as a checksum. If the spam filter rejects one of your messages, the time and reason (such as the score) are kept for 30 days, without content and without recipients; likewise the start and end of a pause.
Aliases: the address, which mailbox it belongs to and when it was created. A deleted alias remains with its deletion time for 180 days so nobody else takes over the address and receives mail meant for you. Creating and deleting are recorded in the account log.
Pro organisation: who is a Pro admin and who appointed them, the number of booked Pro seats and every change to it with time and acting person (basis for billing, not deleted).
Add-on packages: which packages an organisation has booked, how many, and every change with old and new value, price, time and acting person (basis for billing, not deleted).
Filter rules of sarebamail mailboxes: name, conditions (such as sender addresses or subject words) and actions, in plain text as a setting of the mailbox – they are evaluated when mail arrives.
Sender lists (always allow, always block): per mailbox the address or domain, the kind, when and by whom it was added – in plain text as a setting, like filter rules.
Files in chat: the server stores no content. It knows name, size, type and checksum (encrypted like a message) and who has the file on a device. It only passes on the signals for setting up the connection, without storing them. The content is on the devices of those involved.
Background in video calls: your choice and your own background images are kept only in this browser (local storage), not on the server. sarebamail serves the detection model itself; the camera image is processed on the device.
Status: what you choose yourself (status, status message encrypted, until when) and when you were last online, to the minute, with your setting whether others may see it. “Offline since” is only shown roughly (5 minutes, hour or day). How long someone has been away comes from the last input in a window or – reported by the agent, only as the number of seconds since the last input on the computer – on the computer (in memory only) or from when the status was chosen, and is shown just as coarsely.
Read state in chat: per conversation and participant only up to which message something was delivered and read, plus your read-receipt setting. Disappearing messages are deleted after their period together with call entry and file description; messages written before stay.
Own calendar: title, place and description encrypted; in plain text start, end, time zone, series rule, exceptions of a series and the reminder (minutes before), plus for two days which reminder was already sent. Out-of-office note of own mailboxes: the text encrypted; so nobody gets a reply twice, only a check value of the sender address and the time, for 7 days. Own contacts, tasks and notes: the whole entry encrypted; in plain text only whose it is and when it was created and changed.
Meetings: title encrypted; in plain text start, end, time zone, organiser, who accepted or declined and the addresses of external invitees (otherwise no invitation or cancellation could be sent). A link for guests is stored encrypted.
Guests via link: the name, the state in the waiting room and the access are kept only in the server’s memory (the access only as a checksum) and expire as soon as the guest leaves, stops responding or the meeting is over. Guests do not appear in the call log. What a guest writes in the chat stays in the history like any chat message – name and text encrypted together, without an account.
Reactions: who reacted to which message with which emoji – the emoji encrypted. GIFs: the GIF details (Wikimedia Commons id, title, author, license) encrypted like a message; sarebamail does not store the image itself, it fetches it from Commons when needed. Wikimedia sees the sarebamail server and the search term, not your address.
Editing and deleting: when editing, the new text replaces the old one (encrypted); only the time of the last edit is stored – the old text is not kept. A deleted message remains as a placeholder with sender and time; its content is deleted.
Legal notice, privacy policy, terms and the texts of the system emails: every saved version with time and the account that saved it. That keeps traceable which text applied when; earlier versions are not deleted.
Outbound check (mailsecurity by sareba): to check it, mailsecurity by sareba receives the content of every message you send from the sarebamail mail server, including messages to sarebamail addresses. mailsecurity by sareba processes the content only for the check; its log records sender, number of recipients, result and score.
Mailing lists (Pro): the members' addresses and one unsubscribe link per member. Messages waiting for approval are stored encrypted with us until a Pro admin approves or rejects them; the organisation's Pro admins see the sender address. Approvals and rejections are logged with time and acting person in the organisation's log. With the archive switched on, every distributed message is stored encrypted with us until a Pro admin deletes it – never automatically; members with a sarebamail mailbox and the organisation's Pro admins can read it.
Shared mailboxes and forwarding (Pro): who has access and whether read only; for forwarding, who last changed it.
My files (Pro): the content is stored in encrypted blocks on separate storage in the EU, each file with its own key, which in turn is stored encrypted with us; file and folder names are encrypted too. Size, times and which file is in which folder remain in plain text. Only what you delete yourself is deleted – from the trash after your plan's period; an interrupted upload is discarded after 24 hours. For sharing we store who shares which folder or file with whom, with which permission and since when – without names or content; the share disappears with the item or the user. Earlier versions of a file are stored encrypted just like the current one, with time, size and who uploaded them. App passwords: only a check value (SHA-256), the device name, when it was created and last used; every drive sign-in, every failed attempt and every creation or revocation is in the sign-in log. Links for outsiders: only a check value of the link (SHA-256), a password only as an Argon2id hash, expiry, maximum and number of downloads – nothing about downloaders, no IP and no program. The link sits behind # in the address and therefore reaches no server and no log. Expired links are removed after 30 days, the file stays.
Secure mail: the public part of your key, and the key itself only locked – per lock (passkey, passphrase, recovery code) one encrypted copy with type, name, time of creation and last use, for a passkey its identifier. Passphrase, recovery code and the unlocked key do not reach sarebamail. Setting up, adding and removing appear in the sign-in log. Of the organisation recovery key only the public part, who set it when, and its signature; earlier ones remain as replaced. Per secure message in plain text: sender, recipients, time, size and whether read; subject and text only encrypted, plus the wrapped message key per participant and the signed header. Per user the number of secure messages sent per month. Attachments of secure messages: only encrypted blocks in the storage of “My files”, plus size, number of blocks and checksums of the ciphertexts. Recipients via link: their address, expiry, number of wrong attempts and when opened; of the link and of the passphrase check value only checksums (SHA-256), never the passphrase itself. Secure mail log per organisation (who, whom, when, which message – never contents), consent to deputising and recovery requests; never deleted automatically.
Secure mail drafts: only encrypted for your key (recipients, subject and text together); in plain text only who owns the draft, when it was changed and its size. At most 200 drafts, no expiry; they are deleted by you or when sending.
Unlocked key for secure mail and encrypted chats: for at most 12 hours, encrypted in the browser (IndexedDB) with a browser key that cannot be read out; “Lock” and signing out delete it. It never goes to sarebamail.
Problem reports: only when you choose “Report a problem” or “Send problem report…” yourself. Stored are your description and the log shown (error messages, failed requests with path and status code only, version, browser or system; for the agent the end of its log) – encrypted, plus account, time, program and size. Only the operator can read them; they are deleted after 90 days. At most 20 reports a day. sarebamail also creates an entry in the sarebamail team’s internal ticket system (Issue Tracker by sareba, visible to the team only): description, system, version and time, the log as an attached file – not your address, which stays with the report in sarebamail.
Sharing of calendar and address book: who gave whom which level, with the time – no content. Every change is recorded in the owner’s sign-in log. For free/busy and private events the server only sends the time, never title, location or text.
Search at the top: nothing is stored, there is no search index. The mail server searches mail, the server decrypts file names only for that request, and your browser compares everything else with the lists it shows anyway.
Editing at the same time: for the drive, sarebamail only remembers per device (app password) and file which version the device last read or saved – identifiers, no content; the row disappears with the app password or the file. The server log records writes through the drive with file identifier, size and kind (new, version, merged), without names or content.
Editing together live: changes travel through our server to the others who have the file open and are only kept in memory there while someone has the file open – never on disk and never in the log. They are not end-to-end encrypted (like the Office add-on). Nothing is saved until “Save”, which creates a new version as usual.
Backup and restore: a downloaded backup is created while downloading and not stored by us; neither is its password. For restoring, the uploaded file is only kept temporarily on the server (at most 24 hours, does not count towards storage), as is the state saved before a reset. The chat archive stores restored conversations encrypted only for you until you remove an entry. Creating and restoring appear in the sign-in log (which areas, size, never contents).
Automatic backup: per account a public backup key and the private key only locked with your backup password – without the password sarebamail cannot open any of your backups. Plus schedule, retention, time and size of the last backup and an error note (such as “storage full” with the numbers). The backup files themselves are stored in “My files” like any file.
Organisation backup: the file is created while downloading and is not kept on the server; per member a temporary file briefly exists on the server and is deleted right after. For restoring, the uploaded file stays on the server as a temporary copy for at most 24 hours, as for your own account. The sign-in log records backup and restore for the Pro admin and for the member concerned.
Backup by sareba: backups are kept in a separate area of sareba’s backup box (apart from “My files” and from the server backup), in blocks and fully encrypted with your backup key or the organisation’s key, whose private part only your password unlocks. Stored alongside: time, size and kind of each backup, plus schedule and retention.
Backup with a connected mail server: to back up, sarebamail signs in to that server with your stored password (as when reading your mail); nothing additional is stored for this. The content is then only in the backup file.
Blocking: who blocked whom in the chat, with time – until it is undone.
Reports from the chat: addresses of the reporting and reported person, conversation, time; reason and excerpt encrypted. Only the operators see them; resolved reports are deleted after 180 days.
Account deletion: during the 30 days the scheduled time and who requested it. After the final deletion only one line with address, type and times remains for a year (for queries); the address stays reserved for others for 180 days. Messages to others stay with the recipients; the server backups contain the data until they rotate.

Keyboard shortcuts

Ctrl+K or Cmd+K: into the search at the top; arrow keys pick a result, Enter opens it, Esc closes the list.
Message list: Ctrl+click, Shift+click, Ctrl+A, Esc, Space (select the focused row).
Chat: Enter sends, Shift+Enter starts a new line.
Compose: Esc closes the window – asking first if something has already been typed or attached.
Right-click opens a menu with the actions of the area almost everywhere, for example in lists, on appointments, contacts, tasks, notes and chat messages. Ctrl+right-click and right-click in input fields or on selected text show the browser menu (copy, paste).

What's new

What changed in each version is listed on the Updates page (currently version 1.0.0.156). Go to updates

Licences of the software used