Security at ForayMail

Security is our top priority. As a cold outreach platform, we handle sensitive email credentials, lead data, and proprietary campaign strategies. This page outlines the security measures we employ to protect your data.

1. Data Encryption

Encryption in Transit: All data sent to or from ForayMail is encrypted in transit using industry-standard TLS 1.2 or higher. We use secure HTTP headers (HSTS) to ensure browsers interact with our application only over secure connections.

Encryption at Rest: All user data, including database records, backups, and OAuth tokens, are encrypted at rest using AES-256 encryption. Our primary database is hosted securely by Supabase.

2. Authentication and Authorization

Secure Login: We do not store plaintext passwords. All authentication is handled securely via Supabase Auth, supporting strong password hashing and OAuth providers (Google/GitHub).

OAuth Integration Security: When connecting email accounts, we use standard OAuth 2.0 flows. We never see or store your Google or Microsoft account passwords. We only request the minimum permissions (scopes) required to operate the Service.

3. Infrastructure Security

Cloud Hosting: Our infrastructure is hosted on top-tier cloud providers (Vercel, Supabase) that comply with strict security standards, including SOC 2 Type II and ISO 27001.

Network Protection: Our application sits behind firewalls and DDoS protection services to mitigate malicious traffic and automated attacks.

Backups: We perform automated, encrypted backups of our database daily. These backups are stored in a geographically distinct location to ensure disaster recovery.

4. Application Security

Vulnerability Management: We regularly scan our codebase and dependencies for known vulnerabilities and apply patches promptly.

Penetration Testing: We periodically engage third-party security firms to conduct penetration testing and vulnerability assessments on our platform.

5. Compliance and Privacy

We are committed to operating in accordance with major privacy frameworks, including GDPR and CCPA. For more details on how we handle personal data, please review our Privacy Policy.

6. Reporting Security Vulnerabilities

If you are a security researcher and believe you have found a vulnerability in ForayMail, please contact us immediately at security@foraymail.com. We ask that you do not publicly disclose the issue until we have had a reasonable timeframe to address it.