AES-256-GCM encryption
Every OAuth token and sensitive credential is encrypted at rest with AES-256-GCM — the same standard used by banks. Encryption keys live in the runtime environment, separate from the database.
No long-term body storage
Raw email and message bodies are processed by AI for summaries and classification, then discarded — immediately after processing for handled conversations, and within 30 days for everything else. Old content is re-fetched from your provider on demand.
Your data never trains AI
We use OpenAI's API, which contractually never uses API data to train models. Content is processed to generate your summaries and drafts, retained by OpenAI only within their limited abuse-monitoring window, then deleted.
Comprehensive audit logging
Every security-relevant action — logins, data access, integration connections, settings changes — is logged with timestamps, IP addresses, and user agents. Audit logs are automatically purged after 90 days.
Rate limiting & abuse prevention
Redis-backed sliding-window rate limiting protects all API endpoints, with stricter thresholds on authentication. Every rate-limit decision is enforced per user and per route.
Automated data retention
A daily retention job permanently deletes completed conversations past their retention window and strips raw message bodies older than 30 days — keeping only the AI summaries you actually use.
Hardened API surface
Every route runs through a security wrapper: authentication, rate limiting, and audit logging by default. Inputs on sensitive endpoints are schema-validated, and internal errors are sanitized before they ever reach a client.
Full account deletion
Delete your account at any time from Settings. It permanently removes conversations, messages, contacts, AI annotations, rules, integrations, and tokens, revokes OAuth access, and cancels billing. One anonymized deletion record is kept for compliance.
The architecture
Three layers, no exceptions.
TLS 1.2+ on every connection. HTTPS enforced end to end. Nothing travels in plaintext.
AES-256-GCM encryption at rest for credentials. PostgreSQL with every query scoped to your user — strict per-user isolation at the application layer. Automatic backups.
Stateless serverless functions, isolated per request. AI processing via OpenAI's API — never used for training, never stored beyond their abuse-monitoring window.
Compliance
Built for the paperwork too.
GDPR & UK GDPR
Data subject rights honoured in product: access, rectification, erasure, portability, and restriction. EU data residency available via our database provider's EU region.
SOC 2 readiness
Technical controls in place: encryption at rest, audit logging, rate limiting, error sanitization, and automated data retention. Formal audit planned for 2026.
Data Processing Agreement
DPA available for Team and Enterprise customers — contact security@fyltre.com to request one.
Subprocessors
Full transparency on who touches your data, what they see, and for how long.
Responsible disclosure
Found something? Tell us first.
We take every report seriously and aim to respond within one business day.
security@fyltre.comRead how we handle your data day to day in our privacy policy.