Security

Overview

Inboxwire by BufferSol handles access to your users' mailboxes, so we are conservative about what we keep and how we protect it. This page describes our practices. It is not a certification claim. We do not currently hold a SOC 2 report or offer a business associate agreement.

We store less

Message bodies are not stored by default. We keep a metadata index, encrypted credentials and delivery logs. The encrypted payload of a queued send is deleted as soon as the message is sent or fails, outbox records without payload are kept 7 days for idempotency, and we never write message bodies to logs. No person at BufferSol reads mailbox content.

Encryption

• In transit: TLS for the API, dashboard, webhooks and connections to mail providers.
• At rest: OAuth tokens, IMAP and SMTP credentials, OAuth client secrets, webhook secrets and queued payloads are encrypted with AES-256-GCM envelope encryption, using a separate data key for each organization. The master key is kept outside the database.
• API keys are stored only as hashes. They are shown once when created.

Access control

API keys are scoped (read, send, admin) and bound to one environment by default. Dashboard members have roles. Connect links are single use and expire after 24 hours. Webhooks are signed with HMAC-SHA256 and a timestamp header so you can verify them. Administrative actions are written to an append-only audit log.

OAuth and provider access

You connect Google and Microsoft through your own OAuth clients, so you control the scopes and can revoke access in your own consoles. We request only what the features you use require. Deleting a mailbox revokes its stored token.

Engineering practice

We align our application controls with OWASP ASVS level 2. We scan dependencies and run dynamic scans before releases, and we aim to ship with no high or critical findings. We block webhook deliveries and IMAP/SMTP connections to private, loopback and cloud metadata addresses. We provide a CASA Readiness Kit on every plan with evidence about our own components, to help you with Google's assessment of your application. It does not replace that assessment.

Hosting and subprocessors

The hosted service runs on the providers listed on our subprocessors page, in the United States. Self-hosted customers run it on their own infrastructure and control where data lives.

Incidents

If we confirm a breach affecting your data, we will tell you without undue delay, as described in the data processing addendum. Status is published on our status page.

Report a vulnerability

Email legal@buffersoltech.com with the details and steps to reproduce. Please give us reasonable time to fix the issue before disclosing it, and do not access data that is not yours or degrade the service. We will acknowledge good faith reports.