Home / Company

Security at Donezo Inbox

Updated October 15, 2026. Competitor prices read from the vendors' own pages on October 15, 2026.

Your mail stays in Gmail: your browser reads it straight from Google with a short-lived token, and Donezo Inbox does not copy it into its own database. We are in the process of getting SOC 2. Until a report is issued we claim no attestation, so this page says what is in place today, what we store and what we are still closing.

Where does your email live?

In Gmail, where it always did. The browser talks to Gmail directly using a short-lived access token our server hands it. The server brokers tokens, runs scheduled work and serves AI and connector requests; it is not a mail store. Hosting, TLS and DDoS protection are Cloudflare's.

What does Donezo Inbox store?

Your Google sign-in token (a refresh token), encrypted at rest. It is never sent to your browser or to an AI tool.
Your settings, snippets and the rules you write.
Snoozes, reminders and follow-ups (conversation ids and due times, no content), and scheduled sends. A scheduled email's content is stored until it is sent or cancelled, and that content is not encrypted at the application layer.
If you switch on the assistant: each conversation's category and an activity log (subject and sender, kept 14 days), plus short excerpts of your own sent mail used to match your writing tone.
Your plan and billing identifiers. Card details go to Polar and never reach us.

A test fails our build whenever a new database column could hold a message body, snippet or header without a written reason.

How is it encrypted?

In transit: HTTPS everywhere, through Cloudflare.
At rest, application layer: Google tokens, your own server-side AI key and similar secrets are sealed with AES-GCM using a key held as a Worker secret. One key covers all of them, so rotating it means re-linking accounts.
At rest, platform layer: Cloudflare encrypts its D1 and Durable Object storage. That is Cloudflare's statement; we have not audited it.
There is no option for customers to hold their own keys.

How do sign-in and sessions work?

Sign-in is Google OAuth. Donezo Inbox has no passwords. If your Google account uses Advanced Protection, its hardware-key rule applies, because the sign-in is Google's own.
A session is a random id in an HttpOnly, SameSite=Lax, Secure cookie, valid for 90 days and stored on the server. Each session records when it started, when it was last used, a device description and a country guess. It records no IP addresses.
You can list and revoke sessions in Settings, then Security.

What happens to your mail when you use AI?

That depends on the provider you pick. With your own key, a model on your computer or Chrome's built-in model, the text goes from your browser to the one you chose. With our hosted AI, which is part of Pro, requests run on Cloudflare Workers AI. Nothing is sent to an advertising network, and your mail is never used for ads. The assistant never sends email on its own.

Can you delete your data?

Yes. “Delete my data” in Settings removes every row about you, revokes the Google tokens, stops Gmail notifications and ends your subscription. We make no backups of our own. Cloudflare's point-in-time recovery for the database applies on their side, and we have not verified its retention for this deployment, so deleted rows may persist in that recovery window.

What are we still closing?

SOC 2: we are in the process of getting it. No report has been issued yet, and we claim no attestation until one is. We hold no ISO 27001, HIPAA or PCI attestation.
A third-party penetration test has not been done yet.
No strict Content-Security-Policy yet, no web application firewall rules of our own and no automated dependency scanning configured.
No formal vulnerability response time commitment, and no data processing agreement template yet.
We have not pinned a data jurisdiction for the database.
Google's restricted-scope verification and security assessment are required before the service can leave Google's 100-user cap. We are working through them, and sign-up stays limited until they are done.

Which third parties are involved?

Cloudflare (hosting, storage, hosted AI), Google (mail, sign-in, read-only calendar), Polar (payments) and PostHog (product analytics: page views and feature-use counts, never mail content; see the privacy policy). Only if you choose them: your own AI provider and any CRM you connect.

How do you report a vulnerability?

Email ankur@kmfv.cc, or use the contact in security.txt. We will acknowledge it, fix it and credit you if you like. There is no bounty.

Questions

Does Donezo Inbox read my email?

Your browser reads it from Gmail to show it to you. The server does not keep a copy of your mail. If you switch on the assistant, it stores each conversation's category and an activity log of subject and sender for 14 days.

Is Donezo Inbox SOC 2 certified?

Not yet. We are in the process of getting SOC 2. No report has been issued, so we claim no attestation today. This page lists the controls that are in place and what we are still closing.

Can admins or Donezo staff read my mail?

There is no code path for staff to read your mail. Support access needs your explicit permission, or a legal requirement.

See it for yourself

The live demo runs with sample mail, no sign-in.

Try the live demo Continue with Google