Security overview

Effective October 30, 2026

Your inbox holds your work and your clients' words, so we treat security as the first requirement, not a feature. This is what we do today. To report a problem, write to denizonatworks@gmail.com.

Getting in

• Who can sign in: you sign in with Google, and only the addresses allowed on an account can sign in to it. Everyone else is turned away before reaching any page or data.
• Sessions:
  • A session is a signed cookie that scripts can't read and that travels only over HTTPS.
  • It is checked against a record on the server on every request.
  • It ends after 30 days, or after 7 days without use.
  • You can sign out of every device at once.
• Repeated attempts: failed sign-in attempts are limited, so guessing can't go on.

Your data

• In transit: everything travels over HTTPS. Browsers are told to use nothing else (HSTS).
• Gmail access: the keys that let Due email reach your Gmail are encrypted in our database (AES-256-GCM). The encryption key is kept separately, in our host's secret store.
• Where it lives: the app's servers and its database run in the European Union (Frankfurt). Requests reach them through our host's global network, and our host keeps its request logs in its own systems.
• One person per instance: today each person's Due email runs separately, with its own database, keys and address, so one person's data can't appear in another's.
• Logs: our own error logs record what failed and the kind of error. They are written so that they don't include the content of your email or the addresses in it. Our host's request logs record which pages were asked for, which can include an identifier such as a conversation's number.

The app

• Pages: each page allows only the scripts we sent with it (a content security policy with a fresh value per page). No other website can show Due email inside a frame of its own.
• Requests: a request that changes something must come from Due email's own pages. Requests addressed to any name other than ours are refused.
• AI: AI requests are limited per minute and per month, so a mistake or a stolen session can't run up costs.
• Sending: nothing is sent from your mailbox unless you press Send.

How we work

• Secrets: they live only in our host's secret store. They are never in our code or our logs.
• Changes: every release runs our automated tests first, including checks that every part of the app refuses requests without a signed-in session. A failing test stops the release.
• Dependencies: we regularly check the software we depend on for known vulnerabilities.
• Backups: the database can be restored to any point in the last 24 hours. Any other backup copies we keep are deleted within 30 days.
• Access: only the person who runs Due email can reach the production systems, with two-step verification on those accounts.

If something goes wrong

If a security incident affects your data:

• We act to contain it.
• We tell you without undue delay.
• Where the law requires telling a data protection authority or the people affected, we do so. Where you are responsible for that data, we help you do so. Each step happens within the time the law sets: under the EU's GDPR, for example, an authority must hear within 72 hours.

Reporting a vulnerability

If you find a weakness, write to denizonatworks@gmail.com. Please give us time to fix it before telling others. Don't access data that isn't yours while testing.