Security
Updated 2026-11-12
InboxPolicy is operated by Sorcerai LLC. This page says how we protect the service and your data. Our privacy policy says what we collect and how long we keep it.
Connections
- Every connection to
inboxpolicy.com,api.inboxpolicy.comandmcp.inboxpolicy.comuses TLS 1.2 or TLS 1.3. Older versions are refused. - A request sent over plain HTTP is redirected to HTTPS, and we send an HSTS header so browsers stay on HTTPS.
- Our API and MCP servers are reached only through Cloudflare. They expose no public web port.
Your API key
- We store only a one-way hash (SHA-256) of your key, never the key itself. We cannot read a key back.
- Every request checks the key again, so a revoked key stops working at once. If a key is lost or exposed, email us and we will revoke it.
- When you connect from Claude or ChatGPT, the app never sees your key. It holds an encrypted access token that lasts 30 days. Our MCP server decrypts it in memory for each request and does not store or log it.
- The dashboard keeps your key in your own browser's storage. Session replay does not load on the dashboard or in a browser that holds a key.
The addresses you check
- A check asks the receiving mail server whether the mailbox exists and then disconnects. No message is sent to the address.
- Addresses are never sold, shared for marketing, or used to build lists.
- Our server logs are built to leave out full keys, access tokens and the addresses you check. The privacy policy lists what is logged and for how long.
Payments
- Card payments are processed by Stripe. We never see card numbers.
- x402 payments settle on-chain in USDC on Base. We see only the public wallet address that paid.
Hosting
Servers are located in the EU (Sweden).
Report a vulnerability
Email hello@inboxpolicy.com with what you found and the steps to reproduce it. While testing, please do not access other customers' data or disrupt the service. Our contact details are also published at /.well-known/security.txt.