Built to be trusted with your inbox.

Here’s what protects your account today, and what we’re adding before mailbox connection goes live.

In place today

We store a one-way hash using the algorithm and settings OWASP recommends. Nobody at Inboxed can read your password.

Sessions use random tokens in HTTP-only, same-site cookies. We store only a hash of each token, and resetting your password signs out every device.

Turn on an authenticator-app code for your account, with one-time recovery codes. Inboxed staff must use it to reach internal tools.

Repeated failed logins are slowed down per account and per network, and error messages never reveal which emails have accounts.

Viewer, SDR, AE, manager, admin and owner permissions are checked on our servers for every action, not just hidden in the interface.

Every query is scoped to your workspace. Teammates in one client workspace can’t see another’s leads or replies.

Launches, payments, invites, role changes and approvals are recorded with who did them.

Campaigns with phishing patterns, credential requests or hidden links are blocked before they can launch.

Wallet credit is added only after a signature-verified confirmation from the card processor, so it can’t be faked from the browser.

Gmail and Outlook connection through Google- and Microsoft-reviewed OAuth apps (no stored email passwords)
SAML single sign-on (Okta, Google Workspace, Microsoft Entra)
Encryption of stored mailbox tokens with managed keys
Independent security assessment and a public data processing agreement

Found a vulnerability? Email security@inboxed.si. We respond as a priority.

No subscription, no card to start. Connect a mailbox and warmup begins in under a minute.