Security

stored_emails.body_text is encrypted with Fernet (AES-128-CBC + HMAC-SHA256) using a per-deployment symmetric key. Bodies are decrypted in-process only for extraction; the database never holds plaintext.

Verified by an integration test that reads the raw on-disk column and asserts the plaintext keywords don't appear in the ciphertext, and that an ORM read decrypts back to the original text.

JWT bearer tokens. Access tokens are short-lived (15 minutes); refresh tokens (7 days) are rotation-based — each refresh issues a new pair and revokes the old refresh in the DB. Reuse of a revoked refresh fails with 401.

Passwords are hashed with bcrypt. New passwords must be at least 12 characters with a digit and a letter, and at most 72 bytes — bcrypt's input limit; we refuse longer passwords outright rather than silently checking only a prefix. Plaintext passwords are never logged.

Phase 5 adds: email OTP on register, stronger password rules, sliding-window rate limiting with lockout, password-reset by link.

HTTPS in production. CORS is allowlisted to octoplusapp.com. We send strict transport-security and content-type headers; framing is denied; the script-src CSP is same-origin.

We request read-only mail scopes only (Gmail's gmail.readonly, Microsoft's Mail.Read) — OctoPlus can never send, modify, or delete anything in your mailbox. Mailbox credentials are held server-side, encrypted at rest, and are never exposed to your browser.

Disconnecting a mailbox revokes our access with the provider and deletes the stored credentials; deleting your account does the same for everything. Details in the Privacy Policy.

Found something concerning? Email security@octoplusapp.com with details. We'll triage within 72 hours and credit reporters who request it.