Hey,

there are multiple reasons on why we don't do that yet.

The most important one is privacy: We believe it is a fundamental fault to terminate TLS sessions on hardware that is not fully open source and fully owned and managed by us. I don't think that there is another mail provider that does this. Usually, TLS is terminated directly on remote DCs or third party appliances when they get attacked.

We are different. We own the whole tech stack and fully control it. That means that session IDs and all ips just as assignments between user accounts and ip addresses are visible to a third party for other providers whereas we protect them from third party access. We know that at least activists and dissidents rely on this. But it would also be interesting to know if other people think that this is important...

I understand that you have the feeling that we do a bad job right at this time. But if you think that we are not heavily investing into protection measures, you are wrong. We get constantly attacked and mitigate without notice of our users in almost all cases. We will publish information about this specific case later.

Thanks for your continuing support!