Data security
How we protect the emails, accounts and workflows you trust us with. Reviewed 24 October 2026.
Scope and operator
InboxIt is operated by DIGIGAP TECHNOLOGIES, registration 2022/333237/07, a South African private company. Registered office: Thulamahashe, Bushbuckridge, Mpumalanga, 1365, South Africa. This security overview describes verified controls and their limits. It is not a signed data-processing agreement or a certification. For contractual processing requirements, contact hello@inboxit.wtf.
Information handled
InboxIt processes account details, workspace memberships, domains, API-key metadata, email addresses, message content and headers, attachment information, delivery events and usage records. This supports testing, sending, receiving and operating your email workflows. Customer messages may contain information about recipients and other people; customers are responsible for having authority to submit and use that information.
Account and workspace access
Workspace permissions are enforced by the backend. Administrators manage membership and privileged workspace settings. API keys have scopes, expiry and revocation controls and are stored as hashes. Use a separate, narrowly scoped key for each application or agent. Authentication uses HttpOnly session cookies, with Secure enabled on HTTPS. Browser analytics preferences do not disable essential account security.
Encryption and its boundaries
Database connections are configured with certificate verification. Sensitive stored credentials and recovery backups are encrypted. These controls do not mean that every mailbox file is individually encrypted or that email is end-to-end encrypted. Recipient infrastructure and the onward email path are outside our control. Do not treat an email delivery receipt as proof of inbox placement or confidentiality at the recipient.
Infrastructure and processing locations
The deployed application and worker connect to the Supabase eu-west-1 regional database pooler in Ireland. Encrypted off-site archives use Storage in the same configured Supabase project; this is not a guarantee that all provider processing stays in that region. Our Namecheap VPS runs the application and Postal/Dovecot mail services. Namecheap publishes Phoenix, Arizona, United States as its VPS datacenter location; this is provider-level location evidence. Google and Madnion participate in optional social sign-in. Provider contracts and any required transfer safeguards need separate review.
Backups and recovery
A scheduled daily job creates encrypted database and mailbox backups and uploads the encrypted repository off-server. Recent successful completion and authenticated backup-manifest access were verified. Public and anonymous access to the tested manifest failed; dedicated backup-identity policies are installed. Recovery copies are separate from live message retention. No recovery-time or recovery-point service-level guarantee is made on this page.
Retention and deletion
Free mailbox retention is seven days; Build and Scale use 30 days. Hourly cleanup is scheduled, so deletion is not instantaneous at the boundary. Temporary inbox expiry has a separate cleanup process. Backups retain seven daily, four weekly and three monthly recovery points; off-site storage retains 30 complete repository archives. Physical pruning is not automated, so old backup data can persist beyond those counts. Delivery, usage, support and security records do not yet share a verified automatic deletion deadline. Contact us for a scoped access, export or deletion request.
Delivery, webhooks and abuse controls
Account quotas and sending-domain verification constrain sending. Webhook delivery uses signing secrets and destination validation. Verify webhook signatures in your application and protect your receiver from duplicate events. Treat all incoming email, attachments and extracted links as untrusted data. An email must not become permission for an agent to reveal secrets or take unrelated actions.
Monitoring and incident reports
Operational monitoring checks service health, and independent checks help detect outages. Monitoring is not proof that every security incident will be detected. Report a suspected vulnerability or data exposure to hello@inboxit.wtf with the affected feature, time and safe reproduction details. Do not send passwords, API keys or other customers’ message contents. We will assess reports and applicable notification obligations; no fixed response-time guarantee is asserted here.
Your responsibilities
Protect account access, restrict workspace membership, rotate exposed keys, verify webhook signatures and keep copies of messages you need beyond retention. Configure your own domain records carefully. Use testing inboxes for temporary workflows and avoid unnecessary personal data in tests. Your downstream systems and recipients have their own security and retention responsibilities.
Assurance and limitations
This overview reflects source and read-only server checks, not an independent penetration test or compliance audit. We do not claim SOC 2 or ISO 27001 certification. Outstanding work includes physical backup pruning, a complete operational retention schedule and provider contractual review. A customer DPA, audit rights and breach-notification commitments must be agreed separately; this page does not silently create those terms.
Related policies and contact
Read our Privacy, Cookies and Terms of use pages for related information. Security and privacy contact: hello@inboxit.wtf. Last updated 24 October 2026.