Security

Reachbox connects to your mailboxes and other accounts and stores lead data, so we treat security as part of the product. This page describes what we do and what we do not claim.

Protecting connected accounts

• Mailbox credentials are encrypted at rest before they are stored.
• Passwords are stored as salted hashes, never in plain text.
• Reachbox paces sending and tracks mailbox health, including cooldowns, so that your accounts are not pushed into unsafe sending volumes.

Protecting data

• Traffic between your browser and Reachbox is encrypted in transit with HTTPS.
• Each workspace's data is separated from other workspaces, and access is checked on every request.
• Internal admin tooling is separate from the customer product.
• Card payments are handled by our payment provider; we never see or store full card numbers.

Operations

• Infrastructure runs on a major cloud provider.
• Access to production systems is limited to the people who need it.

What we do not claim

Reachbox does not currently hold third-party security certifications such as SOC 2 or ISO 27001. If your procurement process needs specific documents, ask us and we will tell you plainly what exists.

Reporting a vulnerability

If you believe you have found a security issue, email security@reachbox.site with the details and steps to reproduce it. Please give us a reasonable time to fix it before disclosing it publicly, and do not access other people's data, disrupt the service, or run denial-of-service tests. We will acknowledge your report and keep you updated.

Your part

• Use a strong, unique password and keep your login private.
• Connect only mailboxes and accounts you are authorised to use.
• Remove team members and disconnect accounts you no longer need.