How do I verify a forwarded email?

Ask the mailbox owner to export the original email as a .eml file, then upload it to selfcheck.email. The DKIM signature on the original indicates whether the content is unchanged.

What does DKIM verification establish?

A valid DKIM signature establishes that the email content has not been altered since the sender's mail server signed it. It does not establish that the content is true or that a specific person wrote it.

Yes. You can verify up to 5 emails per hour without an account. Free accounts get 5 cases per month with timestamped PDF reports.

Does SelfCheck store my email?

No. The email file is processed in memory and deleted immediately. Only cryptographic hashes and the PDF report are retained.

Trust Centre

Everything you need to evaluate SelfCheck for professional use. If something is missing, let us know.

1. Legal identity

Legal nameHandyHope CIC

Company number16540333

TypeCommunity Interest Company (CIC)

Registered addressYeovil, Somerset, United Kingdom

ICO registration[✓]ZB993576

ICO status[✓]Registered

The Community Interest Company structure includes a statutory asset lock: company assets must be used for the community purpose stated in the Articles of Association and cannot be distributed to private shareholders. This provides structural assurance to public-sector and legal users that the service is operated in the public interest.

2. Privacy model

Source email fileDeleted immediately after processing (0 days)

Verification report (PDF)90 days default; configurable 7–365 days

Hashes and case metadata12 months

Audit logAppend-only, 6 years

Email body contentIncluded in PDF report only (with owner's consent); not stored separately

AttachmentsNot stored; coverage status recorded in report

The original email file is parsed in memory, verification checks are run, and the file is deleted immediately. Message content enters the PDF report only with the owner's recorded consent. Only hashes, metadata, and the report are retained.

3. Provider access

Google (Gmail)[...]In development — not available in production

Microsoft (Outlook/365)[...]In development — not available in production

Yahoo[...]Planned

File upload (.eml/.msg)[✓]Available

Verification supports .eml and .msg file upload. OAuth-based retrieval is under development and will require Google CASA assessment before launch.

4. Security posture

InfrastructureHetzner Cloud (EU, Germany)

TLS[✓]All connections encrypted in transit

At-rest encryption[✓]AES-256 (volume encryption)

No external analytics[✓]No third-party scripts loaded

No external fonts[✓]Self-hosted — no third-party requests

Penetration test[✓]Not yet performed — scheduled Q4 2026

Secrets management[✓]Environment variables, never in repository

5. Compliance status

ICO registration[✓]ZB993576 — registered

Cyber Essentials[...]In progress — target Q1 2027

Google CASA assessment[...]In progress

ISO 27001[...]In progress

UK GDPR compliance[✓]Lawful bases: mailbox owner's recorded consent (art. 6(1)(a)); performance of contract for the requesting organisation (art. 6(1)(b)); legitimate interests for third-party data in the message (art. 6(1)(f)), supported by a documented balancing assessment

DPA templateAvailable on request

SubprocessorsHetzner (infrastructure), DigiCert (timestamping), Sentry (error monitoring)

Vulnerability disclosure[✓]security.txt published — see /.well-known/security.txt

We continuously improve our compliance posture. This page is updated as statuses change.

6. Methodology versioning

SelfCheck uses the mailauth library (MIT) behind a verdict-engine facade. The engine version is recorded in every verification report.

Verdict engineBuilt on mailauth (RFC 6376 / RFC 8617)

Signature verificationmailauth

Forwarding chain verificationmailauth

TimestampTrusted timestamping + OpenTimestamps

Methodology owner[...]To be published

Every report references the methodology version. Methodology documentation: to be published.

7. Known limits

What this report does not establish

•A valid seal confirms integrity — not that the domain belongs to the organisation it resembles. Always check the domain itself.
•That the content of the message is true or accurate
•That a specific person wrote or sent the message
•That the sending account was not compromised
•That unsigned parts of the message were not changed

Verification confirms that a message was sealed by the sending domain and has not been altered since. It does not verify sender intent, truthfulness of content, or identity beyond the domain level. A valid seal from a domain does not confirm that the domain belongs to the organisation it resembles. Our three-level verdict (VALID / INCONCLUSIVE / FAILED) with a coverage map is designed to communicate these nuances precisely.

···