Security
This page describes the security measures we have in place today. It is a living document and will be updated as the service evolves.
Encryption in transit
All traffic between your browser and our servers uses HTTPS with TLS. We also use security headers to reduce common attack vectors.
Encrypted tokens
Gmail refresh tokens are encrypted before they are stored in our database. They are only decrypted inside server-side code when needed to request a short-lived access token from Google.
Least-privilege Gmail access
We request only the Gmail scopes required for the service to work: reading mail, modifying labels, and managing basic Gmail settings for features like send-as aliases. We do not ask for access to Google Drive, Contacts, or other services unless a feature explicitly requires it.
Row-level isolation
Database tables use Row Level Security (RLS) policies so that each query only returns data belonging to the authenticated user. Multi-tenant access patterns are enforced at the database layer.
Authentication
Authentication is handled through Supabase Auth with Google OAuth. We do not store Google passwords. Sessions are managed with short-lived access tokens and secure refresh rotation.
No plaintext secrets
API keys, encryption keys, and provider secrets are kept in environment variables and secret stores. They are never committed to source control or returned to the client.
Dependency and vulnerability review
We run security scans on dependencies and backend permissions. Findings are triaged and fixed before they reach production.
Reporting vulnerabilities
If you believe you have found a security issue, please email hello@mail.mangopop.email with enough detail for us to reproduce it. We will respond as quickly as we can.
Compliance notes
We design features with data-protection principles in mind, including data minimization, user access controls, and deletion workflows. Specific compliance certifications or attestations will be listed here only once they have been formally completed and verified.