Security & trust

Your credentials are encrypted (AES-256-GCM)

IMAP/SMTP passwords and secrets are encrypted at rest with AES-256-GCM. Every purpose (CSRF, OAuth state, signing) uses a separately derived subkey, so a leak of one purpose never compromises credential encryption.

Nothing is sent without your click

Only /api/send can send an email, gated by a server-signed CSRF token bound to your account and the request origin, valid for 5 minutes. Every other send path (auto-drafts, auto follow-ups, autopilot replies) is permanently disabled. Autopilot classifies, moves, archives — it never sends.

• ✓Re-send guard: any hard-bounced or blocked address is refused before sending.
• ✓Anti-phishing: deceptive URLs, brand impersonation, SPF/DKIM/DMARC.

Events are signed (HMAC-SHA256)

Every event delivered to your systems carries an X-BumbleBox-Signature header (HMAC-SHA256 over timestamp + body), with 5-minute replay protection and constant-time comparison. Endpoints are SSRF-guarded (no private IPs/localhost). You can rotate your signing secret anytime, with a dual-key grace window for zero downtime.

Your data stays in Europe

The API, database (PostgreSQL) and processing run on sovereign infrastructure in France (OVH). Traffic flows over an encrypted tunnel. Your data is never sold, nor used to train third-party models.

Team access without sharing a password

On a shared inbox, members get roles (admin / editor / view-only). Every action (assign, send, delete) is recorded in an activity log. Mailbox credentials are never exposed to members.

GDPR & consent

No analytics or error-tracking loads before your explicit consent (GDPR Article 6). You can export or delete your data anytime. Data controller: ICRAFT SAS, 58 Rue de Monceau, 75008 Paris (RCS Paris 992314237).