Delivery risks
Can Email Scanners Open a Collogue Link?
How link previews and scanners interact with a browser-only encrypted URL.
Published: January 30, 2026
Current implementation boundary
Current Collogue links carry the encrypted payload in the URL. The browser uses Web Crypto API: PBKDF2-SHA-256 with 310,000 iterations derives a 256-bit AES-GCM key from the separately entered password, with a random 16-byte salt and a 12-byte IV. The current client has no application API request for creating, retrieving, or storing messages.
The password is not encoded in the link. The implementation does not provide one-time viewing, server-side deletion, or an expiry timer. Treat the full link as sensitive and share the password through a separate channel.
Further context
Modern email systems do not merely deliver text. They inspect URLs, rewrite them, open destinations in scanning environments, generate previews, and perform checks at the moment a user clicks. Microsoft Safe Links, for example, supports URL rewriting and time-of-click verification. Other gateways and collaboration tools have their own behaviors.
- rewrite the original URL;
- request the destination during delivery;
- request it when the recipient clicks;
- follow redirects;
- render the page in a sandbox;
- create a preview;
- inspect linked resources;
- record click metadata;
- revisit the URL later.
Not every product does all of these things. Policies differ by organization.
With the current browser-only design, there is no server-side message to consume. A request for the URL can still expose the URL itself to a gateway or preview service, but it cannot decrypt the payload without the separately shared password.
User-agent filtering is unreliable because user agents can be missing, generic, or forged. Do not rely on it as a privacy control.
Microsoft’s documentation describes both URL scanning and time-of-click verification. Administrators can configure rewriting and exceptions. Other security products may scan during delivery or in sandboxes.
“Safe Links can never affect Collogue.”
The defensible statement is that security systems may process URLs. Collogue does not create a server-side read event, but the complete URL should still be treated as sensitive.
- Do not open the recipient’s final link as a test.
- Tell the recipient to keep the link private and use the separately shared password.
- Use a temporary, revocable credential.
- If the link or password may have reached the wrong person, rotate the credential.
- Avoid public link shorteners or analysis services.
- Confirm the destination address before sending.
- Test your organization’s mail environment with non-sensitive sample messages.
For managed corporate deployments, administrators may be able to configure trusted-domain handling. Such exceptions reduce scanning protection for that domain and should be reviewed cautiously.
- Open the link only when ready to use the information.
- Do not paste it into an online URL checker.
- Do not forward it casually.
- If it does not open, confirm that the complete URL and password were copied correctly.
- Treat a password, token, or recovery code as potentially exposed until replaced.
Microsoft Safe Links can perform time-of-click verification and URL rewriting according to policy. That processing may introduce requests or redirects before the final page is shown.
User-agent detection is incomplete and easy to evade. It may support diagnostics but should not be treated as proof that a request came from a person.
If both the link and password may be exposed, revoke or change the credential, create a fresh one, and send a new link. Do not resend the same secret.
Collogue can reduce persistent exposure in email and chat, but it cannot control every link scanner or delivery policy.