Nexamail is built on the principle that your inbox belongs to you. This page explains exactly how we protect it — in plain language, no jargon.
Security overview
Our security philosophy is straightforward: collect the minimum data needed, secure it at every layer, give you full control, and design every feature so that you must explicitly approve any outbound action. Security is not a feature bolted on at the end — it is the starting point for every decision we make.
Authentication
- OAuth-only mailbox access — we connect to Gmail and Outlook through their official OAuth flows. We never see, request, or store your provider password.
- Account sign-in — Nexamail accounts use modern password hashing or single sign-on via Google. Sessions are short-lived JWTs sent in Authorization headers — never in URLs.
- Revocable at any time — disconnect from Settings, or revoke access directly from your Google or Microsoft security settings. Disconnection is immediate.
Encryption
- In transit: TLS 1.2+ on every connection between your browser, our servers, and email providers.
- At rest: AES-256 on the database and on every storage bucket.
- OAuth tokens: refresh tokens are stored encrypted, scoped to a single account, and never exposed to client-side code.
OAuth permissions — what we ask for and why
When you connect Gmail or Outlook, you'll see a consent screen listing exactly what we need. We ask for the minimum scopes required and nothing more.
- Read mail — so we can show your inbox, draft replies, and surface follow-ups. We never read messages we don't display to you.
- Send mail — only used when you hit Send. Nexamail never sends on your behalf without explicit approval.
- Calendar (optional) — used to show meeting context next to email threads. Skip this scope and email still works fully.
- Offline access (refresh token) — lets us sync new mail in the background without forcing you to log in every hour.
You can revoke Nexamail's access at any time from your Google or Microsoft security settings — disconnection is immediate.
Access controls
- Role-based access — internal access to systems is granted by role and reviewed regularly.
- Least privilege — every component, integration, and team member receives only the access required to do its job.
- Secure token handling — service-role keys live only on the server, never in browser code, and only privileged backend operations use them.
- Row-level security on every database table — your data is invisible to other users at the database layer, not just the API layer.
- Rate limiting on AI and authentication endpoints prevents abuse and protects your quota.
Infrastructure security
- Cloudflare — edge delivery with DDoS mitigation, bot protection, and global WAF.
- Database — hosted on Supabase with row-level security enforced at the database layer.
- Encrypted backups — daily encrypted backups on a 30-day rolling window.
- Isolated regions — application servers run in isolated regions with no shared state between users.
AI security
- Isolated processing — AI runs only on the emails you've already chosen to surface (drafts, summaries, follow-up detection).
- Transient prompts — providers process prompts in memory and do not retain content for model training under our enterprise terms (OpenAI, Google).
- No public model training — your data is never blended into a shared training corpus, sold, or shown to other Nexamail users.
- Human approval required — no message is sent, no calendar invite is accepted, and no workflow is executed without your explicit confirmation.
- Opt-in AI memory — disable it entirely from Settings → Privacy & Safety; existing memory can be wiped in one click.
AI analysis & privacy
Scam analysis and subscription detection are processed using secure systems and are designed to minimise data exposure wherever possible.
Nexamail only performs analysis required to provide the requested feature.
We continuously improve our security systems to protect user information.
Billing security
We never see or store your card details. Payments are processed by Stripe (PCI-DSS Level 1). We only store the subscription status and the customer reference Stripe gives us.
Incident response
- Security monitoring — our systems are monitored for abuse, suspicious activity, service degradation, and unauthorised access attempts.
- Investigation — security incidents are investigated promptly. Impacted systems may be isolated, patched, or restricted as necessary.
- Prioritisation — we prioritise and address security issues according to severity, risk, and impact.
- User notification — if an incident materially affects your data, we will notify impacted users as required by law and good practice, with the facts we have and the steps we are taking.
- Log retention — logs are retained only as long as needed for security, reliability, and compliance, with access restricted to authorised personnel.
Vulnerability disclosure
If you've found a vulnerability, please report it to security@nexamail.ai. We aim to acknowledge reports promptly and prioritise remediation according to severity, risk, and impact. We don't pursue researchers acting in good faith who:
- Avoid accessing, modifying, or destroying data that doesn't belong to them.
- Avoid degrading the service for other users.
- Give us a reasonable opportunity to remediate before public disclosure.
Availability and resilience
- Backups — daily encrypted backups with a 30-day rolling window.
- Recovery — defined recovery procedures for restoring service after database, infrastructure, or provider incidents.
- Service continuity — critical paths are designed to degrade gracefully when an upstream provider has issues.
- Status — real-time status at status.nexamail.ai.
Security roadmap
Security controls, infrastructure protections, and compliance programmes will continue to evolve as Nexamail grows. We regularly review our practices and adopt additional safeguards as the product and threat landscape change.
Trust indicators
- OAuth-based access — we never store your provider password.
- Revocable permissions — disconnect any time, from Nexamail or directly from your provider.
- We never sell your data.
- We never build advertising profiles from your inbox.
- We never send emails autonomously — every outbound action requires your explicit approval.
- We never train public AI models on your private emails.
What we will never do
- Sell your data, ever.
- Train AI models on your private emails.
- Send mail or accept calendar invites without your explicit approval.
- Retain OAuth tokens after you disconnect an account.
- Share your inbox content with advertisers or third parties.
Status & uptime
Real-time status: status.nexamail.ai.