Encryption in transit and at rest
All traffic to and from FlackEmail uses TLS 1.2 or higher. We redirect HTTP to HTTPS and use HSTS on customer-facing domains.
Data at rest in our primary database and object storage is encrypted using AES-256 keys managed by our cloud provider.
Authentication
Each account has its own credentials. Passwords are hashed with a modern password hashing function before they touch our database; we never store them in plain text.
Multi-factor authentication (MFA) is available for every account and is strongly recommended for admin users. We support TOTP authenticator apps. SSO is on the roadmap.
Access controls
Internal access to production systems is role-based and follows least-privilege: people get the smallest set of permissions they need to do their job, and only for as long as they need it.
Production access requires MFA. Sensitive actions are audit logged. Logs are reviewed periodically and retained for a reasonable period.
Infrastructure
FlackEmail runs on managed cloud infrastructure with established security lineage (such as AWS and Hetzner, which hold recognised certifications including SOC 2 and ISO 27001 for the relevant services).
We do not run our own data centres. We use the security primitives our providers offer (VPCs, security groups, managed databases, managed secrets) rather than rolling our own.
Backup and recovery
We take regular automated backups of customer data with point-in-time recovery on our primary database. Backups are encrypted at rest and stored separately from production.
We test restore procedures periodically. Our objective is to recover from infrastructure failure with minimal data loss and within a few hours.
Application security
Every code change goes through review before it reaches production. We use automated dependency scanning to flag known vulnerabilities in our libraries and patch on a defined cadence.
We commit to running a third-party penetration test at least once per year as the product matures, and we will publish a summary of findings (without exploitable detail) on the Trust pages.
Incident response
We maintain a written incident response process: detect, triage, contain, investigate, communicate, learn.
If an incident affects customer data, we will notify affected customers without undue delay and in any case within 72 hours of becoming aware, in line with our DPA and GDPR Article 33.
Responsible disclosure
If you have found a security issue in FlackEmail, please email security@flackemail.com.
We will acknowledge within 2 business days, work with you in good faith, and credit you (with your permission) once the fix is shipped. We do not currently run a paid bug bounty; that may change as we grow.
What we don't promise
We are a small, founder-led team. We are not promising 99.99% uptime, SOC 2 Type II, or a full enterprise compliance binder at this stage. We are honest about that.
What we do promise: we will tell you the truth about how we operate, we will fix what we get wrong, and we will improve our security posture as the company grows. The Trust pages will track that progress in public.