Security
Where your mail lives, and who can read it.
Email is the most personal data a product can hold. Here is where ours sits, how it is protected, how long it is kept, and what we have and have not been certified for.
01 · Compliance
GDPR today. SOC 2 next.
- GDPR
- Compliant
- Pidgeon is operated from the European Union and processes your data as your processor under a data processing agreement that applies automatically, with nothing to sign.
- SOC 2
- Coming soon
- We do not have a SOC 2 report yet. If your review needs one, tell us when — it helps us plan the audit.
- Subprocessors
- Listed in full
- Every company that touches your data, what it does with it, and the region it does it in.
02 · Where it lives
Your mail stays in Europe.
Each piece of the system, and where it runs.
- Ireland
- Receiving, sending and the raw originals of your messages run on Amazon SES and S3 in the EU (Ireland) region, and only there.
- Application
- Ireland
- The API and the web app run on Vercel, pinned to its Dublin region.
- Database
- European Union
- Accounts, messages and their metadata are held by Supabase in the European Union.
- Mail clients
- London
- The IMAP and SMTP service your mail apps connect to runs in London.
03 · How it is protected
Encrypted, scoped, and logged.
- In transit
- TLS, everywhere
- Between your code and the API, between mail servers where they support it, and between our own services.
- At rest
- Disk and object storage
- Encrypted at rest, with a customer-managed KMS key on the bucket that receives your mail. Message bodies are not encrypted again inside the application: your code reads them as plain text over the API, and search needs to read them too.
- Keys
- Narrower, never wider
- An API key can be scoped to one address and one level of access, can only create keys narrower than itself, and takes its descendants with it when it is revoked.
- Mail clients
- One password per mailbox
- IMAP and SMTP use app passwords scoped to a single mailbox, never your API key.
- Inbound mail
- Read before your agent
- Pidgeon Firewall marks every inbound message that tries to instruct the agent reading it.
- Audit
- 90 days of events
- Every event is written to a log you can read and replay, kept for 90 days, and cannot be deleted earlier.
04 · How long it is kept
Until you delete it, or sooner.
- Messages
- Until deleted
- Or for as long as your workspace’s own retention policy says, from 1 day to 10 years. Deleting a message deletes its raw original too.
- Raw originals
- 30 days
- The message as it arrived, kept for 30 days so a parsing problem can be fixed.
- Your account
- Erased on request
- Closing your account erases its data, overriding every window on this page. An encrypted backup taken before then keeps it until that backup rotates out.
05 · Report a problem
Found something? Tell us first.
- Privacy and data
- privacy@pidgeon.ai
- Access, export or deletion requests, and anything a regulator would ask.