Built to be trusted with your inbox.
Here’s what protects your account, your mailboxes and your data today, and what we’re still adding.
In place today
Passwords hashed with Argon2id
We store a one-way hash using the algorithm and settings OWASP recommends. Nobody at Inboxed can read your password.
Secure sessions
Sessions use random tokens in HTTP-only, same-site cookies. We store only a hash of each token, and resetting your password signs out every device.
Two-factor sign-in
Turn on an authenticator-app code for your account, with one-time recovery codes. Inboxed staff must use it to reach internal tools.
Login protection
Repeated failed logins are slowed down per account and per network, and error messages never reveal which emails have accounts.
Roles enforced on the server
Viewer, SDR, AE, manager, admin and owner permissions are checked on our servers for every action, not just hidden in the interface.
Workspace isolation
Every query is scoped to your workspace. Teammates in one client workspace can’t see another’s leads or replies.
Audit log
Launches, payments, invites, role changes and approvals are recorded with who did them.
Content scan before launch
Campaigns with phishing patterns, credential requests or hidden links are blocked before they can launch.
Mailbox credentials encrypted at rest
Mailbox passwords, app passwords and sign-in tokens are encrypted with AES-256-GCM before they are stored, using a key kept outside the database. They are decrypted only to send, warm up and sync your mail.
Google and Microsoft sign-in
Sign in with your Google or Microsoft account instead of a password, if you prefer.
One-click Outlook connection
Outlook and Microsoft 365 mailboxes connect through Microsoft's own sign-in screen, so Inboxed never sees the mailbox password. One-click Gmail is coming; today Gmail connects with an app password.
Single sign-on and provisioning
Owners and admins can set up SAML 2.0 or OpenID Connect single sign-on (Okta, Microsoft Entra ID, Google Workspace and others) and SCIM 2.0 user provisioning, from Settings.
Data processing agreement
Our DPA and sub-processor list are public. The DPA can be downloaded as a PDF and accepted for your workspace in Settings. They are drafts pending legal review while our company registration completes.
Verified card webhooks
When card top-ups open (soon), wallet credit will be added only after a signature-verified confirmation from the card processor, so it can’t be faked from the browser.
Still on the way
- One-click Gmail connection (today Gmail connects with an app password)
- Encryption keys held in a managed key service, with scheduled key rotation
- An independent security assessment (penetration test) by an outside firm
Found a vulnerability? Email security@inboxed.si. We respond as a priority.
Warm up today. Launch when you’re ready. Pay only for emails that send.
No subscription and no card to start. Warmup and verification are free; emails cost $1 per 1,000 as they send.