Security

Last updated: 16 August 2026

Encryption

All communication runs over TLS. Data is encrypted at rest, and access tokens for inbox and calendar are additionally encrypted at the application layer with a key held outside the database.

Separation between companies

Every resource belongs to a specific organisation, and access requires confirmed membership. The separation is enforced by the type system in code and verified by automated tests on every change.

Access and permissions

Roles within an organisation limit what each person can do. Sessions rely on short-lived access tokens and rotating refresh tokens — reusing a spent token invalidates all sessions and is recorded in the audit log.

Mailbox permissions

We request read-only access. VeyCue never sends messages on your behalf and never modifies your mailbox. You can disconnect at any time, which revokes the token at the provider.

Files

We treat uploaded files as potentially dangerous: we limit types and size, process them in an isolated step, and serve them through short-lived signed links.

Reporting vulnerabilities

Found a security issue? Email [email protected]. We respond within 72 hours and take no legal action against good-faith researchers.