We built the encryption model before we built the features. Here's every layer, in plain English.
Six encryption and access control layers protect your data from the moment it enters our system to the moment you disconnect.
All communication uses TLS 1.2 or higher. HSTS enforced. Server-to-server calls also require TLS 1.2+.
All stored data — database rows, sessions, cached metadata — encrypted with AES-256. Keys managed in cloud KMS.
OAuth tokens get additional field-level encryption with a separate KMS key on a documented rotation schedule.
Raw email body text is never written to disk — read, normalized, and discarded. Only suggestions persist.
Email text sent to our AI provider has zero data retention and no training, contractually guaranteed.
No standing human access. Break-glass access is logged, alerted, and requires written justification.
Four things you can do at any time, without contacting us.
Report it to security@inboxcopilot.com. We acknowledge within 24 hours and give a status update within 5 business days.
📧 security@inboxcopilot.com