Security

Aux0 holds credentials to other people's mailboxes. That is a serious thing to ask of a customer, so this page says how they are protected, who can reach them, and what we have not certified yet.

Credentials

Every credential — an OAuth refresh token, an app password, a DAV password — is stored with envelope encryption. Each credential version gets its own data encryption key and nonce, encrypted with AES-256-GCM, and that key is wrapped by a separately managed master key. The authenticated data binds each envelope to the organisation and credential it belongs to, so an envelope copied to another row or another tenant fails to decrypt rather than silently resolving.

Credentials are never returned by the API, never written to a log, and never sent to a sub-processor. Plaintext exists only in memory for the duration of a provider call, and the buffer is cleared afterwards.

Master keys are versioned and held in a dedicated secret manager, separate from application configuration. Rotation re-wraps existing envelopes without re-encrypting the data beneath them.

Isolation

Every object belongs to a project, and every API key is scoped to one project. Queries are tenant-scoped at the data-access layer rather than by convention in each handler.

Each project also declares the provider scopes it is allowed to request. Because providers grant permissions per user and per client, and those grants accumulate, a stored token can carry more than a project ever asked for. Aux0 enforces the project's declared set on every call and rejects anything outside it, rather than trusting what the token happens to permit.

Aux0's data lives in its own database, with its own role. The role cannot read any other database.

Access control

• API keys are scoped per project and can be restricted to read-only. They are shown once, stored hashed, and revocable immediately.
• Dashboard access is per organisation with named members and roles. Every privileged action is attributed to a person or to a key.
• Production access is limited to named engineers, requires multi-factor authentication, and is logged.
• No engineer reads end-user content as a matter of course. Where debugging a specific problem requires it, it happens with the customer's explicit agreement and is recorded in the audit log.

Encryption in transit

TLS everywhere: between you and the API, between Aux0 and every provider, and between our own services. Provider connections use the provider's own requirements, which for mail means IMAPS and SMTP over TLS, never plaintext.

Bring your own OAuth client

You can connect end users through your own Google or Microsoft OAuth credentials rather than ours. Your brand appears on the consent screen, the grant is between your application and your user, and the provider relationship is yours. We think this is the right default for a product with its own security posture, so it is available on every paid plan rather than as an enterprise upsell.

Retention and deletion

Retention is a project setting. Set it to zero and Aux0 keeps only ids, timestamps and the account each object belongs to — enough to deliver a webhook and nothing else. Disconnecting an account deletes its credentials immediately and its content within 30 days. The privacy policy sets out each retention window.

Incidents

If we find a breach affecting your data or your end users', we will tell you what happened, what was reached and what we have done, without waiting until the investigation is complete. We will not discover an incident from a customer and describe it as routine maintenance.

To report a vulnerability, write to hello@aux0.com. We will acknowledge it within two business days. We do not currently run a paid bounty, and we will not threaten anyone who reports something in good faith.

Compliance, stated accurately

SOC 2 Type II is in progress and not yet certified. A Type II report is a third-party attestation covering an observation period, so it is true only once an auditor has issued one. Exa Labs LLC is working towards it across its products; we will publish the report when it exists, and until then we would rather say this than imply otherwise.

Applications using restricted Google scopes are subject to Google's own verification and to an annual independent security assessment. Aux0 is going through both.

Infrastructure runs on Google Cloud Platform and Cloudflare, whose own certifications cover the layers they operate. Those are theirs, not ours, and we do not present them as ours.

What we have not built yet

Aux0 is new. Single sign-on for the dashboard, customer-managed encryption keys and a published penetration-test report are all things we intend and none of them exists today. If one of them is a requirement for you, say so and we will tell you honestly where it is rather than where we would like it to be.