You're handing us the keys to your mailboxes and your clients' pipelines. That trust is the entire business. So security isn't a checkbox page here. It's how the system is built, from credential storage up to the access model.
Two layers that are non-negotiable: nothing moves in plaintext, and nothing rests in plaintext.
Browser to app, API, webhooks, and every call to Google, Microsoft and our other providers run over TLS. Connections to your own SMTP and IMAP servers use TLS on ports 465 and 993, and STARTTLS where your server offers it. Data at rest is encrypted with AES-256, including the database, file storage and backups.
The most sensitive thing we hold is your access to a mailbox. OAuth is always preferred over passwords. Whatever we must store is encrypted with AES-256-GCM before it reaches the database, and is never written to the audit log.
The honest version. For Gmail and Microsoft we never see a password at all, only a scoped OAuth grant you can revoke. For raw SMTP, the credential is sealed before it ever lands in storage.
When you connect a Gmail or Microsoft 365 mailbox, NuMail receives a delegated OAuth token scoped to your mail: reading, sending and organizing messages, with no access to contacts, calendar or files. We never ask for, see, or store your account password.
For SMTP/IMAP mailboxes that have no OAuth path, the SMTP and IMAP passwords are encrypted the moment they arrive, before they are stored. They are decrypted in memory only when a job needs them: to send, to check the inbox for replies, or to hand our always-on IMAP worker the connection it keeps open.
Every workspace, and every agency sub-workspace, is a hard tenancy boundary. Machine-to-machine endpoints sit behind their own secrets, and sensitive actions are written to an audit trail.
Every query is scoped to a workspace id at the data layer. Agency parent and sub-workspaces are separate tenancy boundaries: a sub-workspace cannot read another client's leads, mailboxes, or replies, and the parent only sees what the model explicitly grants.
The dashboard, the API and the background jobs run as one application, which receives its production secrets as environment variables at runtime; they are never committed to code. Internal machine-to-machine endpoints, such as the IMAP worker's credential feed and the schema setup route, each require a bearer secret, compared in constant time.
Sensitive actions (mailbox connects and removals, member invites and role changes, API keys created, rolled or revoked, data exports, and support sessions opened by our staff) are written to an audit log with actor, timestamp, and source. Entries cannot be edited or deleted from the product. Agency admins can read the trail of each client sub-workspace.
The app is served only over HTTPS on Vercel's edge, with HSTS. The database and the job service are managed providers reached over authenticated, encrypted connections. Calls to Google and Microsoft go through their official, authenticated APIs. Sign-in codes, invites and the contact form are rate limited.
Our database provider keeps encrypted point-in-time history we can restore from. Every campaign email is claimed in the database before it goes out, so a retried or duplicated job cannot send the same step twice, and a send whose outcome is unclear is held for review rather than retried blind.
Role-based access on every plan, so each person sees only the workspaces they belong to and only the settings their role owns.
Invite teammates with a role, not a free-for-all. Roles map cleanly to what a person actually needs: a copywriter drafting sequences shouldn't be able to rotate API keys or change billing. Our own support staff can only open your workspace through a support session that is recorded in your audit log.
Where we are today, stated plainly, with no green checkmarks for things that aren't done yet.
Built for GDPR from the data model up: lead deletion from the dashboard, workspace-wide suppression lists, and erasure of message history on request. We act as processor; you remain the controller of your contact data.
Our Data Processing Agreement applies to every customer, agencies acting for their clients included, and a counter-signed copy is available on request. The complete sub-processor list is published in it and kept current. Read the DPA →
Security researchers make this product safer. If you've found a vulnerability, report it. You'll have our attention and our safe harbor.
Email us with a description and reproduction steps. We acknowledge reports quickly, keep you updated as we triage and fix, and credit researchers who want it. Good-faith research that follows this policy will not lead to legal action from us. That's our safe-harbor commitment.
✉ security@numail.aiReviewing NuMail for an agency or an enterprise rollout? We'll walk through architecture, sign your DPA, and answer the questionnaire.