Hushmail is an encrypted proprietary web-based email service offering PGP-encrypted e-mail and vanity domain service. Hushmail uses OpenPGP standards. If public encryption keys are available to both recipient and sender (either both are Hushmail users or have uploaded PGP keys to the Hush keyserver), Hushmail can convey authenticated, encrypted messages in both directions. For recipients for whom no public key is available, Hushmail will allow a message to be encrypted by a password (with a password hint) and stored for pickup by the recipient, or the message can be sent in cleartext. In July, 2016, the company launched an iOS app that offers end-to-end encryption and full integration with the webmail settings. The company is located in Vancouver, British Columbia, Canada. History Hushmail was founded by Cliff Baltzley in 1999 after he left Ultimate Privacy. Accounts Individuals There is one type of paid account, Hushmail Premium, which provides 10GB of storage, as well as IMAP and POP3 service. Hushmail offers a two-week free trial of this account. Businesses The standard business account provides the same features as the paid individual account, plus other features like vanity domain, email forwarding, catch-all email and user admin. A standard business plan with email archiving is also available. Features like secure forms and email archiving can be found in the healthcare and legal industry-specific plans. Additional security features include hidden IP addresses in e-mail headers, two-step verification and HIPAA compliant encryption. Instant messaging An instant messaging service, Hush Messenger, was offered until July 1, 2011. Compromises to email privacy Hushmail received favorable reviews in the press. It was believed that possible threats, such as demands from the legal system to reveal the content of traffic through the system, were not imminent in Canada unlike the United States and that if data were to be handed over, encrypted messages would be available only in encrypted form. Developments in November 2007 led to doubts amongst security-conscious users about Hushmail's security specifically, concern over a backdoor. The issue originated with the non-Java version of the Hush system. It performed the encrypt/decrypt steps on Hush's servers, and then used SSL to transmit the data to the user. The data is available as cleartext during this small window of time, with the passphrase being capturable at this point, facilitating the decryption of all stored messages and future messages using this passphrase. Hushmail stated that the Java version is also