Stored in the Nordics
The database and application servers run in Stockholm, Sweden: Supabase (Postgres) in eu-north-1 and Vercel functions in the same region. Daily database backups are kept for 7 days.
Encryption
- All traffic uses TLS (HTTPS). The website and app send strict transport security headers.
- Data is encrypted at rest by our hosting providers.
- Mailbox access tokens are additionally encrypted by Spolt with AES-256-GCM, and can only be read by the server, never from the browser.
- Your own AI provider keys are stored in an encrypted vault.
Workspace isolation
Every table that holds customer data is protected by Postgres row-level security, so each request can only see the workspace and records its user is allowed to see. Mail is private to the person who connected it unless they or the workspace share it.
Sign-in
You sign in with a one-time code sent to your email, so Spolt stores no passwords. New sign-ups are approved before they get access.
Mailbox access
- We ask only for the mail permissions the product needs, listed in the Privacy Policy.
- Spolt AS is a Microsoft verified publisher.
- Disconnecting a mailbox revokes our access and deletes the synced mail and everything derived from it.
AI
AI requests go through Vercel AI Gateway to providers whose terms do not allow training on your data. Requests for search embeddings and ranking are sent with zero data retention. See the sub-processor list.
Operations
- Production access is limited to Spolt staff who need it.
- Secrets live in our hosting providers' encrypted environment settings, never in source code.
- Every change passes automated checks before it reaches production.
Report a vulnerability
Email security@spolt.io. We reply within 3 working days and will not take legal action against good-faith research that respects our users' data. Our security.txt has the details.