Your mail is sensitive.
We treat it that way.
Our support staff have no access to your inbox. Your mail is encrypted, access to it is locked down and logged, and the people who built InflowMail do security for a living.
How your mail is protected
Encrypted in transit
Every connection to InflowMail uses HTTPS, and we reach Google, Microsoft and IMAP servers over encrypted connections too.
Encrypted at rest
Our database, stored message bodies and backups are encrypted with AES-256.
Your own key, held in AWS's key service
The credentials that let us reach your mailbox are encrypted with a key unique to your account, locked by AWS Key Management Service. A copy of our database alone holds no readable mailbox credentials.
See when your mail is opened
The Data Access Log in your security settings shows when message content was opened through InflowMail.
Why we can sort your mail, and who can't read it
To sort, search and summarize your mail, our servers need to be able to read it, the same as Gmail or Outlook, so it isn't end-to-end encrypted. Instead it is encrypted in storage and in transit, the keys are held in AWS's key service, and our support staff have no tool to open your mailbox.
Who can get to your mail
Our support staff have no access to your mailbox.
We work from what you send us: a screenshot or diagnostics from the app. Support never changes your sign-in details on request.
Support works from what you send us
No one at InflowMail opens your mailbox to provide support; our support staff have no tool for it. Send a screenshot or diagnostics from the app, and quote the support code from your profile so we know it's you.
Admin powers need a second step
Our admin tools need an administrator role and a code from an authenticator app, and that step-up expires.
A written record
Admin step-ups and admin API actions are written to an audit log.
You're in control
- Two-factor sign-in with an authenticator app and backup codes.
- See every signed-in browser and app, and sign out any or all of them.
- Helpers sign in as themselves, never with your password, and see only the mailboxes you choose. Delegation
- Disconnect any mailbox and we erase our stored credentials for it.
- Export your data, or delete your account and the mail we synced.
AI and your mail
Runs in our own AWS account
By default, our AI features use Amazon Bedrock, called from our own AWS account.
Not used for training
We don't use your mail to train AI models, and under AWS's terms Bedrock doesn't either.
Nothing happens without your OK
The assistant can't send email, change your rules or archive mail in bulk until you press Confirm.
Built by people who do this for a living
InflowMail's founders come from application security and cloud architecture: building secure, scalable cloud solutions and the monitoring that watches over them. InflowMail is built and run the same way.
How we build and run it
- Threat modeling, and a security review on every change.
- Automated scanning of our code, dependencies and secrets.
- Sign-in required by default; the short list of public pages is reviewed and pinned by a test.
- A dedicated, isolated AWS environment in the United States.
- A private, encrypted database that can't be reached from the internet.
- Continuous threat detection and audit logging (Amazon GuardDuty, AWS Security Hub, AWS CloudTrail).
Your data stays yours
You can export or delete your data at any time; see our Privacy Policy. Our use of data from Google follows the Google API Services User Data Policy, including its Limited Use requirements.
InflowMail is not yet verified by Google for full Gmail access, so Google shows a "Google hasn't verified this app" screen when you connect. You can also add Gmail over IMAP with an app password. What to click on Google's screen
Want the technical detail?
The deep dive covers sign-in, encryption, access controls and inbox threat protection.
Security deep dive