InboxLean is built for people who trust us with their email. This page summarizes our security posture. For legal detail see the Privacy Policy.
Principles
- Minimal permissions. We request only the OAuth scopes needed to organize mail, create drafts, and produce digests.
- Never auto-send. Reply text is written to Drafts. Sending stays under your control.
- No selling. No training on your mail. Your email is not sold and is not used to train general AI models.
- You can leave cleanly. Disconnect Google/Microsoft anytime and request deletion.
Tokens & encryption
OAuth access and refresh tokens are encrypted at rest. Connections to Google and Microsoft use TLS. Secrets are stored in a managed secrets system, not in source control.
Access control
Production access is limited to operators who need it. Human access to mailbox content is exceptional and governed by our Privacy Policy (support with your consent, security incidents, or legal requirement).
Platform reviews
Before broad Gmail and Outlook availability we complete Google’s OAuth verification (including restricted-scope review / CASA assessment as required) and Microsoft publisher verification. Until then, access is waitlist and capped test users only.
Infrastructure
We host on reputable cloud providers with network isolation, automated backups on a short retention cycle, and monitoring for errors and abuse (including rate limits on public forms).
Your responsibilities
- Use a strong, unique password for InboxLean (when accounts open) and enable available MFA.
- Review AI drafts before sending.
- Revoke InboxLean in Google Account → Security → Third-party access, or Microsoft account permissions, if you stop using the product.
Report a vulnerability
Email support@inboxlean.com with “Security” in the subject. Please give enough detail to reproduce the issue. Do not include unnecessary personal data in the report.