Security at the heart of your business email
Your company email holds conversations, documents and access to other services. ViviMail makes security part of the everyday platform, from signing in and connecting devices to filtering incoming mail and controlling administrative access.
This overview explains our published protections. For company details, backups, assessment status and the limits of each protection, visit our Security & Trust page. For data processing roles and sub-processors, read Data protection and the data processing agreement in our terms.
Managed email hosting with clear responsibilities
ViviMail provides secure business email hosting with mailbox infrastructure, incoming spam and virus filtering, and platform account protection managed as part of the service. Your organisation manages its users, devices and domain records, following the dashboard instructions. Managed email hosting does not remove the need to keep your devices secure or to check unexpected requests for passwords or payments.
Protecting accounts and devices
Two-step verification is required for every ViviMail account, with passkey support for secure sign-in. Email apps that connect over IMAP and SMTP can't ask for a two-step code, so they use per-device app passwords instead. If a phone is lost or an old computer is retired, you can revoke its app password individually, and an app password can be limited to sending only.
A mailbox's app password can also open that one mailbox in ViviMail webmail or the Android app. That sign-in is limited to the mailbox and, like other email apps, doesn't use two-step verification. Read how app passwords work.
Account passwords are stored as strong one-way Argon2id hashes. API keys and two-factor authentication secrets are encrypted. Automatic alerts help identify suspicious activity and password-guessing.
Encrypted connections
The website, webmail and email apps use TLS to protect data in transit. Connections to other mail servers use encryption where those servers support it. This describes transport encryption; it does not mean that messages are end-to-end encrypted, and ViviMail's servers can process message content for filtering, search and webmail.
In the ViviMail Android app, you sign in with a passkey, through the ViviMail sign-in page with two-step verification, or with a mailbox's app password, which opens only that mailbox. Sign-in tokens and other providers' passwords are encrypted on the phone and excluded from phone backups. The app has no ads or third-party analytics.
Filtering and authenticating email
Incoming email is filtered for spam, phishing and viruses or malware. Remote images from unfamiliar senders remain hidden until you choose to show them. Sending limits help protect the service from abuse, with alerts for suspicious activity and blocklisting.
SPF, DKIM and DMARC setup
Outgoing mail is signed with DKIM. ViviMail guides you through SPF and DMARC records so receiving providers can authenticate legitimate mail from your domain. These controls reduce risks; they do not guarantee that every harmful message will be caught or that every legitimate message will reach an inbox.
Read how domain setup and email authentication work.
Customer separation and staff access
Separation between customer organisations is enforced in the database. Server administration access is restricted to a private network, and changes to security settings raise alerts.
Authorised Viviron staff may access customer accounts, including mailbox contents, where necessary for support, security investigations or legal obligations. Access requires a recorded reason, is time-limited and is logged. We do not sell customer email content or use it for advertising.
UK mailbox storage and data responsibilities
Mailboxes are stored in the United Kingdom. The customer organisation controls its email content, and Viviron Ltd acts as its processor. Viviron is the controller for account, billing and security information about platform users.
Supporting providers can process some personal data outside the UK. Our data protection page lists sub-processors and the applicable safeguards, so UK mailbox storage should not be read as a claim that every supporting service processes all data only in the UK.
You retain ownership of your email and can export it using an IMAP email app. Keep your own copies of business-critical messages. Retention and service-ending arrangements are explained in the terms and privacy policy.
Report a security concern
If you suspect a vulnerability or compromised account, contact security@vivimail.co.uk. Our machine-readable reporting contact is published in security.txt. Send spam or abuse reports to abuse@vivimail.co.uk.
For privacy questions, email hello@vivimail.co.uk with “Privacy” in the subject. Our data protection page explains incident response and notification commitments.
More about how we work
Our Security & Trust page explains how ViviMail protects accounts and email, how the service is run, and who is behind it. The public roadmap shows what is live today and what is coming next.
ViviMail is a product and service of Viviron Ltd, company number 16534437. Core account protection and filtering are included across our business email hosting plans.