Forward Email (email provider)

[forwardemail]

@ph00lt0

So that leaves me with the question do you have any legal representation in any member state of the EU? This is a requirement defined in Article 27 of the GDPR . I was not able to find any contact for this on your website.

@ph00lt0 Yes, thank you for pinging us about this!

We’ve updated our GDPR page to include our representative (Osano) and their mailing addresses at https://forwardemail.net/gdpr#gdpr-representative.

Screenshot:

@overdrawn98901

I’ve echoed this, but the only legal way is to have an AGPL-like license. There is nothing to stop forward email from modifying the code they published to be different than the code the run otherwise. In practice I highly doubt they would do this unless there are some secret sauce code that would be risky to release at this time. Otherwise, there is no good way to validate this.

@overdrawn98901 We’ve spent a lot of time meticulously checking our dependencies and license compatibility – which is why some of our code is BSL and some is MPL. We’ve also reached out to the actual authors of source code we use (e.g. WildDuck, which uses EUPL license) to get written permission. We have also donated and sponsored the efforts of several open-source authors and contributors over the years (we know how hard it is to be a maintainer).

For the purposes of staying on topic (we’d love to be included in PG); we aren’t going to dive into a discussion about changing licenses – but here’s a brief overview of our license history:

We originally were entirely MIT licensed, but MIT is not compatible with EUPL (e.g. we can’t do inbound EUPL to outbound MIT), so we opted for MPL in those cases. As we became a business and monetized the service (since it used to just be purely free DNS-based and forwarding only – but now we offer IMAP/POP3/SMTP etc) – we decided to try to protect us from large businesses cloning our service and we introduced the BSL as well. This also opened up the door for enterprise licensing, so we can help public universities and governments now (and actually be a business and stick around for a long time).

In the future we may revisit licensing – but here are some of our bookmarks on AGPL if anyone is curious:

• AGPL is compatible with EUPL (so we could potentially use it)
• Heather Meeker’s article on AGPL (prolific open-source licensing legal expert)
• Drew Devault’s article on AGPL (also has great criteria for a mail service provider; which we think we pass!)

@Niek-de-Wilde

To add on what @ph00lt0 said, cpild you tell me a little about what threatmodel Forwardmail had in mind when they were designing your service and specifically the mailbox encryption.

Also, do you happen to have a security whitepaper.

@Niek-de-Wilde Stay tuned – we’re aiming to publish a draft of our white-paper next week and will follow up in this thread once it’s available for download.

---

P.S. Today we published a press & media page at https://forwardemail.net/press