AES-256-GCM encryption
Every OAuth token and sensitive credential is encrypted at rest with AES-256-GCM — the same standard used by banks. Encryption keys live in the runtime environment, separate from the database.
No long-term body storage
Raw email and message bodies are processed by AI for summaries and classification, then discarded — immediately after processing for handled conversations, and within 30 days for everything else. Old content is re-fetched from your provider on demand.
Your data never trains AI
We use OpenAI's API, which contractually never uses API data to train models. Content is processed to generate your summaries and drafts, retained by OpenAI only within their limited abuse-monitoring window, then deleted.
Comprehensive audit logging
Every security-relevant action — logins, data access, integration connections, settings changes — is logged with timestamps, IP addresses, and user agents. Audit logs are automatically purged after 90 days.
Rate limiting & abuse prevention
Redis-backed sliding-window rate limiting protects all API endpoints, with stricter thresholds on authentication. Every rate-limit decision is enforced per user and per route.
Automated data retention
A daily retention job permanently deletes completed conversations past their retention window and strips raw message bodies older than 30 days — keeping only the AI summaries you actually use.
Hardened API surface
Every route runs through a security wrapper: authentication, rate limiting, and audit logging by default. Inputs on sensitive endpoints are schema-validated, and error details are sanitized before they ever reach a client.
Full account deletion
Delete your account at any time from Settings. It permanently removes conversations, messages, contacts, AI annotations, rules, integrations, and tokens, revokes OAuth access, and cancels billing. One anonymized deletion record is kept for compliance.
The data journey
Follow one message, start to finish.
Here is exactly what happens to a single email or message inside Fyltre — from the moment you connect an account to the moment you delete it.
- 01
Your connected accounts
Gmail, Outlook and Slack connect through OAuth. We never see your password.
- 02
Encrypted gateway
Your access key is sealed with AES-256-GCM before it ever touches our database.
- 03
App layer + AI
Messages are fetched scoped to you, summarized by OpenAI, and never used for training.
- 04
Storage — summaries only
Raw bodies are discarded after processing. Delete your account and it is all wiped.
The architecture
Three layers, no exceptions.
TLS 1.2+ on every connection. HTTPS enforced end to end. Nothing travels in plaintext.
AES-256-GCM encryption at rest for credentials. PostgreSQL with every query scoped to your user at the application layer, backed by Row Level Security enabled on every table as a database-level safeguard. Automatic backups.
Stateless serverless functions, isolated per request. AI processing via OpenAI's API — never used for training, never stored beyond their abuse-monitoring window.
Infrastructure foundation
Built on certified ground.
Fyltre runs entirely on managed cloud infrastructure that is independently audited. Our database and authentication layer is hosted on Supabase, and our application layer on Vercel — both of which maintain SOC 2 Type 2 and ISO 27001 certifications. The physical storage and processing of your data inherits those controls directly.
On top of that foundation, tenant isolation is enforced in our application layer — every database query is scoped to your authenticated user — and backed by Row Level Securityenabled on every table as a database-level safeguard, so one account can never reach another’s data.
Compliance
Built for the paperwork too.
GDPR & UK GDPR
Data subject rights honoured in product: access, rectification, erasure, portability, and restriction. EU data residency available via our database provider's EU region.
CCPA / CPRA
California residents' rights are honoured for everyone: right to know, delete, correct, and non-discrimination. We do not sell or share your personal information, so there is nothing to opt out of.
Google CASA (Tier 2)
Fyltre has completed Google's Cloud Application Security Assessment for its Gmail API access — an independent security review of how the app handles restricted user data.
SOC 2 readiness
Our controls are structurally aligned with the AICPA Trust Services Criteria: encryption at rest, audit logging, rate limiting, error sanitization, and automated data retention are live today. A formal independent SOC 2 Type 1 audit is slated for our upcoming funding milestone.
Data Processing Agreement
DPA available for Team and Enterprise customers — contact support@fyltre.com to request one.
Subprocessors
Full transparency on who touches your data, what they see, and for how long.
Information Security Policy
The principles, controls, and responsibilities that govern how we protect the information entrusted to us.
Incident Response Policy
How we detect, contain, investigate, and communicate security incidents — including when and how we notify you.
For security & procurement teams
Reviewing Fyltre for your team?
We’re happy to support your vendor assessment. Request our infrastructure providers’ SOC 2 Type 2 reports, a completed security questionnaire, or a Data Processing Agreement — and we’ll turn it around quickly.
Request our security docsResponsible disclosure
Found something? Tell us first.
We take every report seriously and aim to respond within one business day. Read our Vulnerability Disclosure Policy.
Report a vulnerabilityRead how we handle your data day to day in our privacy policy.