Inboxer
ConnexionCommencer

Security & Trust

Built for sensitive inbox data

Inboxer is designed around user approval, OAuth-based access, encrypted token storage, and clear controls for disconnecting accounts. This page is the single source of truth for our current posture and the certifications we’re pursuing.

Technical & organisational measures

OAuth-only access

Mailboxes are accessed via the provider's OAuth flow under the scopes the user approves. No calendar scope is requested - meeting prep works from calendar-invite emails already in the mailbox. Inboxer never sees a password.

Encryption

TLS in transit. Database encryption at rest (managed Postgres). Beyond that, OAuth tokens, message and draft bodies, meeting transcripts and briefs, and saved memory entries are all additionally encrypted at the application layer with AES-256-GCM before storage - not just at the database level.

Approval-first AI

AI suggestions never leave your account without explicit human approval. Drafts queue for review; classifications are overridable.

Audit visibility

Connection changes, draft approvals, AI actions, and admin events are recorded in a structured audit log scoped to the workspace.

User data control

Self-serve export and deletion at /settings/data. Deleted no later than 30 calendar days after the deletion request.

Compliance programmes

We don’t claim certifications we don’t hold. This list is kept current; targeted dates are best-effort, not commitments.

GDPR

Live

Public DPA, sub-processor list, in-app DSAR tooling, analytics hosted on PostHog Cloud EU.

AI sub-processor no-training contracts

Live

OpenAI and Anthropic accessed under API / Commercial Terms - customer content is not used to train models.

OpenAI Zero Data Retention (ZDR)

In progress

Application submitted; awaiting approval. Removes the default 30-day retention window on prompts.

Google CASA Tier 2 verification

In progress

Required for Gmail restricted scopes at scale.

SOC 2 Type I

Planned

Targeted within the next two quarters. Controls in build-out with a GRC platform.

SOC 2 Type II

Planned

Follows Type I after a 6-12 month observation window.

ISO 27001

Planned

Targeted alongside SOC 2 for EU enterprise procurement.

Sub-processors

We share data with the 14 sub-processors below, each bound by a DPA under Art. 28 GDPR. The full table with data categories and transfer mechanisms is on Privacy; the machine-readable feed for procurement automation is at /api/v1/sub-processors.

  • Clerk - Authentication, session management, organisation membership.
  • Resend - Transactional email delivery (digests, meeting briefs, notifications, account and reconnection notices).
  • Stripe - Billing, subscription management, payment processing.
  • OpenAI - AI classification, drafting, summarisation, embeddings.
  • Anthropic - AI classification, drafting, summarisation.
  • Recall.ai - Meeting bot ingest of transcripts.
  • Inngest - Background job orchestration. Event payloads carry only IDs.
  • Vercel - Application hosting, CDN, and edge network. All application traffic transits Vercel.
  • Supabase - Managed PostgreSQL database hosting.
  • Sentry - Error and performance monitoring.
  • Upstash - Managed Redis for API rate limiting.
  • PostHog - Product analytics, in-app event tracking.
  • Google (Gmail) - Mailbox access via OAuth, at user direction. No calendar scope is requested.
  • Microsoft (Graph, Outlook, Microsoft 365) - Mailbox access via OAuth, at user direction. No calendar scope is requested.

Incident history

No security incidents have been reported since launch. If that changes, this section will be updated with the relevant details - we won’t retroactively remove or soften a disclosed incident.

Responsible disclosure

If you believe you’ve found a security issue, please report it privately to security@inboxer.so. We commit to acknowledge within 2 business days, work with you on a coordinated fix, and credit you publicly once the issue is resolved (unless you prefer to remain anonymous). Please do not test against other users’ data, attempt social engineering of our staff, or run scanners against production beyond what’s necessary to reproduce the issue. A machine-readable copy of this contact is published at /.well-known/security.txt (RFC 9116).

Documents