Security at InflowMail

How we protect your mailbox connection

• Sign-in uses standard OAuth with PKCE, which protects the connection from being intercepted and replayed.
• Connection tokens and app passwords are encrypted with a key unique to your account. That key is itself locked by a managed key service, is never stored in readable form, and each use of it is recorded. A copy of our database alone does not contain readable mailbox credentials.
• We ask only for the permissions our features use. Calendar and contacts access is read-only.
• You choose how much access each Gmail or Microsoft mailbox gets: Read only (inbox, AI sorting, briefings, search), Read + organise (adds archive, delete, flag, mark read, move and drafts) or Full (adds sending), with calendar, tasks and contacts as optional extras. We act on what the provider actually grants, so if your IT department approves read only, InflowMail reads and never tries to change or send. Change it any time under Connected Accounts. Details for IT: admin consent guide.
• When you disconnect an account, we ask the provider to revoke our access.

Encryption in transit and at rest

Access controls

Signing in to InflowMail

• Sign in with a password, or with your Google or Microsoft account. Passwords must be at least 12 characters, and we turn down passwords known to have leaked in data breaches. That check sends only a short fragment of a scrambled form of the password, never the password itself.
• Turn on two-factor authentication with an authenticator app, and keep a set of single-use backup codes. Our own administrators must use an authenticator app.
• When you sign in from a browser or device we haven't seen, we ask for a code from your authenticator app, or one we email you. If you choose to trust that device, we remember it for 30 days and then ask again; using it doesn't extend that.
• Every sign-in from a new device sends you an email. If it wasn't you, one click on Wasn't me signs you out everywhere: every browser and app session ends, trusted devices are forgotten, API keys are revoked and your password is removed, so you sign back in with an emailed code and choose a new one.
• Your security settings list every signed-in browser and app; sign out any of them, or all at once.
• Repeated wrong passwords or codes lock sign-in temporarily, and sign-in attempts are rate limited.

What we ask your mailbox provider for

When you connect a mailbox, Google or Microsoft shows you the permissions we ask for. Here is what they are for.

Other IMAP accounts connect with an app password, which we store encrypted and you can revoke with your provider. Google data is handled under the rules in Google user data.

Your data, your control

• Disconnect a mailbox anytime from Connected Accounts. You can also remove our access from your provider's side: for Google at myaccount.google.com/permissions, for Microsoft in your account's app permissions.
• We keep message bodies only for your plan's history window, then delete our copy. Your mail stays at Gmail, Microsoft or your IMAP host, which remain the system of record.
• Export your data, or delete your account. Deleting it disconnects your mailboxes and deletes your synced mail within minutes, and the rest of your account after a 30-day grace period; copies in encrypted database backups expire within 14 days.
• We never sell your data and never use it for advertising. We use no advertising cookies; our site analytics count page visits and never see your mail.

Retention periods and your rights are set out in full in our Privacy Policy.

Infrastructure

• InflowMail runs on Amazon Web Services in the United States.
• Production runs in its own isolated cloud account, separate from testing, with its own encryption keys.
• The database sits on a private network and cannot be reached from the internet.
• Traffic passes through a DDoS-protection network before it reaches us.
• The database is backed up automatically, and backups are encrypted.
• We monitor service health with automated alerts, keep an audit trail of activity in our cloud accounts, and run automated threat detection.

AWS holds its own security certifications for its data centers. Those are AWS's; we do not claim them as ours.

Monitoring and logging

• Automated alarms watch the service's health, errors, response times and capacity, and alert us when something is off, including signs that a stolen sign-in is being reused.
• Activity in our cloud accounts is recorded in a tamper-evident audit trail, stored in a separate account and kept for over a year.
• Automated threat detection and configuration checks run across all of our cloud accounts.
• Security events in the app, such as sign-ins, session changes, two-factor changes and administrator actions, go to an audit log kept for two years.
• Our logs record that something happened, not what your mail said.

Backups and recovery

• The database is backed up automatically. Backups are encrypted and kept for 14 days, and the database can be restored to any point in that window.
• The production database and its backups are protected against deletion, both by a setting on the database and by a policy on the cloud account.
• Your mail stays with Google, Microsoft or your IMAP host. If our copy of a message were lost, we would fetch it again from your provider.

If something goes wrong

We have a written incident response plan: how we judge how serious a problem is, how we contain it, and who we tell.

If a security breach affects your personal data, we will tell you without undue delay, and within 72 hours of confirming it, with what happened, what we have done and what you should do. Organizations with a signed Data Processing Addendum get the same commitment in writing.

Companies that help us run InflowMail

We rely on a short list of companies, such as Amazon Web Services for hosting and AI, Cloudflare for the network in front of us, Stripe for payments and Zoho for the emails we send you. The Subprocessors page lists them, what each one receives and where.

AI and your mail

• Much of your mail is sorted by rules without calling an AI model at all.
• When AI helps sort a message, it works from details such as the sender, subject and a short preview. When you ask for a summary, a draft reply or use the assistant, the message content involved is sent to the AI model to produce that result.
• We don't use your mail to train AI models.
• You can bring your own AI key, so requests go to the provider you choose under your own agreement.

More in AI features.

Google verification status

What we read from your Google account, what each permission is for, and the Limited Use rules we follow are set out in Google user data in our Privacy Policy.

InflowMail is not yet verified by Google for full Gmail access. Google classes mailbox access as “restricted”, and verifying an app that uses it requires a paid, independent security assessment (Google's Cloud Application Security Assessment). We have not completed that assessment yet. We plan to, and the controls on this page are in place either way.

Until then, Google also caps how many people can connect Gmail to an unverified app. If you can't connect, you can still add Gmail over IMAP with an app password, or connect Microsoft 365 or another IMAP account.

Protection from threats in your inbox

• Every email is scored for phishing risk, including suspicious links and fake sender names.
• Risky attachment types, such as programs, macros and scripts, are flagged before you open them.
• Attachments are not scanned for viruses. We judge them by file type and name, not by opening them, so keep your own antivirus on.

Reporting a security problem

Found something that looks wrong? Use the support form and start the subject with "Security". It opens a tracked ticket and goes to the people who can fix it. We read every report and we will tell you what we found. Please give us a reasonable chance to fix an issue before making it public.

When you look for problems, use your own account, don't access or change anyone else's data, and don't run tests that could slow the service down for others. Our security.txt file gives the same contact.