Security & Data Subprocessors
Last updated: April 13, 2026
How we protect your data
Encryption in transit
All data is transmitted over TLS 1.2+. No unencrypted connections.
Encrypted at rest
Database encryption using AES-256. Storage volumes are encrypted.
OAuth 2.0 only
We never store your email password. Access is via revocable OAuth tokens.
GDPR compliant
EU data residency options, right to deletion, data portability on request.
No data selling
Your email data is never sold or shared with advertisers or third parties.
Minimal retention
Email content cached only as needed for AI processing. Deleted on account removal.
Google sign-in scopes
Opsense requests only the minimum required scopes ā no Gmail or Calendar API access:
openidVerify your identityuserinfo.emailRead your email addressuserinfo.profileRead your name and profile picture
Email data is read directly from Gmail's interface by the Chrome extension ā no API tokens, no unverified scopes.
You can revoke access at any time from Settings ā Data & Privacy or directly from your Google Account settings.
Subprocessors
These are the third-party services we use to operate Opsense. Each has been evaluated for security and GDPR compliance.
AI email analysis, reply generation, task extraction
Infrastructure hosting, Gmail API integration
Application hosting and edge delivery
Database hosting for user and email data
Payment processing and subscription management
Secure authentication and Gmail access
Secure authentication and Outlook/Microsoft 365 access
Transactional email delivery (notifications, password reset)