Security

The website is served over HTTPS. Sign-in, the dashboard and inbound email webhooks all use encrypted connections. We do not offer an unencrypted version of the app.

You sign in with a one-time code emailed to you, or with Google or Microsoft. Sign-in codes are stored hashed, expire after ten minutes, and the endpoints that issue and check them are rate-limited. Sessions are database-backed and expire after 30 days of inactivity.

Every query for an event, message, action, contact or attachment is scoped to the signed-in account. An identifier in the URL is never enough on its own — if the row is not yours, it is treated as missing.

Incoming email is posted to us by Mailgun. We verify the HMAC signature and reject requests whose timestamp is too old, so a captured webhook cannot be replayed later. Mail sent to an address we do not recognise is acknowledged and discarded.

Attachment files are stored in a private Google Cloud Storage bucket (or a local folder in development). They are never given a public URL. Downloads go through our server, which checks that you own the parent event, then issues a short-lived signed link.

Message text is sent to OpenAI to produce a summary, category, deadlines, actions and contacts. Attachment file contents are not sent — only the file name. Under OpenAI's API terms, data submitted through the API is not used to train its models. We do not use your event content to train models either.

HTML bodies are sanitised on the server and rendered in an isolated frame with scripts disabled. Remote images are stripped, so opening a message cannot run code or tell the sender you opened it.

You can delete an individual event or your whole account from the app. Deleting an event removes its messages, attachments, actions and contacts, including the stored files. Deleting an account does the same for every event you own. There is no undelete.

If you think you have found a security issue, email privacy@in.onehappening.com. Please do not file a public issue with exploit details.