How we keep your
data safe — in writing.

This Policy applies to all information assets owned or processed by Fyltre, including customer email and message content, OAuth credentials, account data, and supporting infrastructure. It governs every employee, contractor, and automated system that interacts with these assets.

The objective is to ensure that information is protected against unauthorised access, disclosure, alteration, and destruction, in line with GDPR, UK GDPR, and the AICPA Trust Services Criteria.

• Leadership — accountable for the security programme, risk acceptance, and ensuring adequate resources for security controls.
• Engineering — responsible for implementing and maintaining technical controls (encryption, access control, monitoring, secure development).
• All personnel — required to follow this Policy, complete security awareness practices, and report suspected incidents promptly.

All information is classified into protection levels, each with defined handling requirements:

• Restricted — OAuth tokens and credentials. Encrypted at rest with AES-256-GCM, never logged, keys isolated in the runtime environment.
• Sensitive — raw email and message bodies. Processed transiently for AI features, then discarded; not retained beyond a 30-day maximum window.
• Internal — AI summaries, classifications, and metadata. Stored with per-user isolation and row-level security.
• Personal data — user email and name. Handled under GDPR with full data-subject rights honoured in product.

• Access is granted on a least-privilege, need-to-know basis.
• All application access is authenticated server-side via our identity provider (Supabase Auth); every database query is scoped to the authenticated user.
• Administrative interfaces require elevated role checks and support multi-factor authentication.
• Access to production systems is restricted to authorised engineers and logged for auditing.

• In transit — all connections secured with TLS 1.2 or higher.
• At rest — credentials encrypted with AES-256-GCM; database storage encrypted at the infrastructure layer.
• Key management — encryption keys held in the runtime environment, separate from the database, never committed to source control.

• Changes are deployed through an automated CI/CD pipeline with build, lint, and type checks.
• Dependencies are pinned and audited; the application loads no code from untrusted sources.
• All API endpoints pass through a security wrapper enforcing authentication, rate limiting, and audit logging.
• Debug modes are disabled in production and error details are sanitised before reaching clients.

Security-relevant actions — logins, data access, integration connections, and settings changes — are recorded in audit logs with timestamps, IP addresses, and user agents. Logs never contain credentials or message content and are retained for 90 days before automatic purge.

We engage vetted subprocessors (including OpenAI, Supabase, Vercel, Upstash, and Stripe) that maintain their own recognised security certifications. Customer content sent to AI processors is never used to train models. The full list is published at /security/subprocessors.

Suspected or confirmed security incidents are handled under our Incident Response Policy, which defines detection, containment, notification, and remediation procedures, including breach notification within the timelines required by applicable law.

Our controls are structurally aligned with the AICPA Trust Services Criteria and GDPR. This Policy is reviewed at least annually, and after any material change to our systems or threat landscape.

Questions about this Policy or our security practices:
Fyltre Ltd — get in touch