InboxCage

Security and privacy

How we protect your data

InboxCage reads your mail to protect it, but does not keep it. We cannot leak what we do not have.

What we keep, and what we never keep

We never store

  • Subjects, message text or attachments
  • Names or full email addresses from your mail
  • Full bank account, IBAN, bankgiro or Swish numbers
  • Excerpts of any kind

We store

  • One verdict per checked email: risk, reasons, the sender's domain, date and folder
  • Addresses you write to, as a code unique to your account (HMAC)
  • Payment details as kind and the last four characters
  • Your mailbox login, encrypted

This is enforced in code: a test fails if the database could hold mail content, and another plants test mails and fails if any of their text is stored.

How your mail is checked

  • We read with read-only commands. Reading never marks mail as read or changes it.
  • Each email is checked in memory and dropped right after.
  • With real-time protection on, we move only clear threats to the folder InboxCage Quarantine. Every move can be undone, and mail you release is never moved again.
  • We never delete, send or edit mail.

How we protect what we keep

  • Mailbox logins are encrypted with AES-256 and a key that never sits in the database.
  • Codes for addresses use a separate key per account, so they cannot be matched across customers.
  • Passwords are hashed with argon2id. Everything runs over HTTPS.
  • Hosting is at DigitalOcean in Frankfurt, Germany.

AI assistants

  • You decide: your assistant asks and you approve, through OAuth 2.1.
  • It can only read. It can never send, move or delete mail.
  • Dangerous mail is withheld. Everything else is cleaned first: hidden text and instructions aimed at AI are removed, and payment details show only the last four characters.
  • You can see connected assistants and disconnect them at once.

Your rights

  • Removing a mailbox deletes its login and everything we found in it.
  • Deleting your account deletes everything of the account.
  • Connectivo AB processes your data on your behalf. A data processing agreement for businesses is on its way.

Questions or a security report: [email protected]