How Hisendy is built to be safe

Last updated 21 September 2026

The short version

Mailbox credentials are encrypted at rest and never reach a browser, including yours.

Every database query is filtered by workspace on the server, not in the front end.

Sessions expire after 30 minutes idle by default and 7 days absolute, and you can revoke any of them.

Report a vulnerability to security@hisendy.com. We reply within one working day.

Where it runs

The whole product runs on Cloudflare: the worker and the database. There is no server we patch, no port left open, and no VPS with a stale operating system. The attack surface is the code we wrote and the four sub-processors we publish.

Your mailbox credentials

Google and Microsoft mailboxes use OAuth with the narrowest scopes that let us send as you and read the replies to what we sent.

Mailbox tokens, and any IMAP or SMTP credentials, are encrypted with a key held outside the database.

Decryption happens only inside the worker, at the moment it talks to your mail provider.

No credential and no token is ever returned to a browser, including yours. The product shows you a connection state, never a secret.

Disconnecting a mailbox deletes the record. It is not archived, flagged or soft deleted.

Tenant isolation

Every query is filtered by workspace on the server before it runs, not by hiding rows in the front end. A workspace identifier is never taken from a request body or a URL and trusted; it comes from the session. The command palette says on the panel itself that results come from this workspace only, because that is enforced rather than implied.

Sessions and access

ControlSetting

Idle session expiry30 minutes

Absolute session expiry7 days

Session revocationAny active session, from Settings, immediately

Password storageSalted hash, never reversible

Minimum password length12 characters

RolesOwner, Admin, Editor, Analyst, Viewer, each with a published permission matrix

What the AI can and cannot reach

A model call receives only the trimmed input for the action you ran. Never your contact list, never another workspace.

Writing and sending are separate operations with separate approvals. No model output can trigger a send.

The credit quote is reserved before the call and settled once. A model cannot raise its own budget.

Prices, dates and claims come from offer facts you approved. A missing fact leaves the line out.

Data in transit and at rest

TLS everywhere, with HSTS. Encryption at rest on the database. A strict Content Security Policy on every response, no inline script in the application, and no third party script on the pages where you are signed in.

What we do not claim

We are not SOC 2 certified and we do not display a badge we have not earned. We are a small team and we would rather tell you exactly how the thing is built than point at an audit we have not had. When we start that process this page will say so, with the date.

Reporting a vulnerability

Email security@hisendy.com. Tell us what you found and how to reproduce it. We acknowledge within one working day, we will not take legal action against good faith research, and we will credit you if you want to be credited.

Please do not test against another customer’s workspace, send real cold email as part of a test, or run automated scanning that degrades the service. Ask us and we will give you an account to test against.