# Inboxer security questionnaire

**Last updated:** 2026-08-07
**Legal entity:** App Studio, SASU (RCS Marseille 917 474 207)
**Live version:** https://www.inboxer.so/security - this file mirrors that page for procurement workflows that need an offline copy. If the two ever disagree, the web page is current.

This is a plain-language answer sheet to the questions that come up most often in vendor security reviews. It only states what's actually true and implemented today - anything not yet in place is labelled "In progress" or "Planned," not claimed as done.

## Data access and authentication

**How does Inboxer access a customer's mailbox?**
Exclusively through the mail provider's OAuth flow (Google or Microsoft), under the scopes the user explicitly approves during connection. Inboxer never receives or stores a mailbox password. See https://www.inboxer.so/permissions for the exact OAuth scopes requested.

**Can Inboxer send email without a human clicking send?**
No. AI-generated drafts queue for review; a human approval click is required before anything sends. AI classifications are overridable at any time.

**How is staff access to production data controlled?**
Access to production data is restricted, audited, and gated behind multi-factor authentication (MFA), using role-based access controls.

## Encryption

**Is data encrypted in transit?**
Yes - all application traffic uses TLS.

**Is data encrypted at rest?**
Yes. The database (managed Postgres) is encrypted at rest. OAuth connection tokens are additionally encrypted at the application layer with AES-256-GCM before storage, on top of the underlying disk-level encryption.

## Backups and data retention

**Are backups encrypted?**
Yes - encrypted point-in-time recovery snapshots, retained up to 30 days.

**What happens to data when an account or connection is deleted?**
Account data is kept while the account is active and deleted within 30 days of a deletion request. Disconnecting a mailbox revokes and deletes its OAuth token within 30 days. Deleted data ages out of backups within the same 30-day window. Self-serve export and deletion tools are available at /settings/data.

## AI processing

**Are customer emails used to train AI models?**
No. Inboxer's AI sub-processors (OpenAI, Anthropic) are accessed under API / commercial terms that contractually exclude using customer content for model training.

**What AI providers process customer data, and under what terms?**
See the sub-processor list at https://www.inboxer.so/privacy (human-readable) or https://www.inboxer.so/api/v1/sub-processors (machine-readable JSON feed), including purpose and transfer mechanism for each.

## Audit logging

**Is there an audit trail of account activity?**
Yes. Connection changes, draft approvals, AI actions, and admin events are recorded in a structured audit log scoped to the workspace.

## Compliance programmes

| Programme | Status |
|---|---|
| GDPR (public DPA, sub-processor list, in-app DSAR tooling) | Live |
| AI sub-processor no-training contracts | Live |
| OpenAI Zero Data Retention (ZDR) | In progress - application submitted, awaiting approval |
| Google CASA Tier 2 verification | In progress |
| SOC 2 Type I | Planned |
| SOC 2 Type II | Planned (follows Type I after a 6-12 month observation window) |
| ISO 27001 | Planned |

We don't claim certifications we don't hold. For the current, most up-to-date status of each programme, see https://www.inboxer.so/security.

## Incident history

No security incidents have been reported since launch. If that changes, this section (and the live page at https://www.inboxer.so/security) will be updated with the relevant details.

## Vulnerability disclosure

Found a security issue? Report it privately to security@inboxer.so. We commit to acknowledge within 2 business days, work with you on a coordinated fix, and credit you publicly once resolved (unless you prefer to stay anonymous). Please don't test against other users' data, attempt social engineering of our staff, or run scanners against production beyond what's necessary to reproduce the issue. A machine-readable version of this contact is published at https://www.inboxer.so/.well-known/security.txt.

## Related documents

- Data Processing Agreement: https://www.inboxer.so/dpa
- Privacy Policy: https://www.inboxer.so/privacy
- Terms of Service: https://www.inboxer.so/terms
- Legal Notice: https://www.inboxer.so/legal-notice
- Sub-processor JSON feed: https://www.inboxer.so/api/v1/sub-processors