Security
How TELVRIX protects your credentials, data, and access.
Credential security
Credential encryption at rest
IMAP and SMTP passwords encrypted using AES-256-GCM with a per-deployment key (CREDENTIAL_ENCRYPTION_KEY). Ciphertext stored; plaintext never written to disk.
Credentials in memory only during use
Decryption happens in the worker/API process at connection time. Decrypted passwords are not logged, cached to Redis, or stored in the job payload.
Credential rotation UI
Users can currently update credentials by reconnecting the mailbox. A dedicated rotate-credentials flow is planned.
Data access controls
Row-level security (RLS)
All user data in Supabase is protected by PostgreSQL RLS policies. Users cannot query other users' rows.
Service-role scoping
Background workers use a service-role key that bypasses RLS, but every query is scoped to a specific user_id — no unbounded cross-user queries.
Admin console privacy
Operators can see health status, sync state, and aggregate counts. Message bodies, subjects, sender/recipient addresses, and credentials are never shown in admin views.
Workspace isolation
Organization workspace data is scoped to members. A user cannot access another workspace's mailboxes or messages.
Authentication
Email + password authentication
Supabase Auth — bcrypt-hashed passwords, secure session tokens.
TOTP two-factor authentication
Time-based OTP via authenticator app. Backup codes available.
Session management
JWT sessions with automatic refresh. Session cookies are HttpOnly and SameSite=Lax.
SSO (SAML / OIDC)
Enterprise-only. OAuth2/SAML integration is on the roadmap for Team and Enterprise plans.
SCIM provisioning
Automated user provisioning/deprovisioning via SCIM 2.0. Post-launch.
Transport security
HTTPS everywhere
All web traffic uses TLS 1.2+. HTTP requests are redirected to HTTPS.
IMAP/SMTP TLS enforcement
SSL/TLS and STARTTLS modes supported. TLS certificate verification enforced in production.
DKIM / SPF guidance
DKIM and SPF are configured at your domain/provider level. TELVRIX uses your own SMTP — we don't control outbound signing. See your provider's documentation.
Compliance roadmap
SOC 2 Type II
Formal audit planned post-general availability. Not certified during closed beta.
GDPR
Data handling aligned with GDPR principles. DPA and formal compliance review planned before EU launch.
HIPAA
Not suitable for protected health information during beta. Do not use for HIPAA-regulated workflows.
Closed beta — no compliance certifications are in place. Do not use TELVRIX for legally regulated email workflows during beta.
Vulnerability reporting
Found a security issue? Email the operator team directly. During closed beta, security reports are handled personally. A public security disclosure policy will be published before general availability.