1. Summary

Encrypted transit and encrypted storage of your mailbox credentials.
Send-only mailbox access. Gmail connects through Google sign-in with permission to send only; other mailboxes connect over SMTP. We never read, scan, or monitor your inbox.
Row-level access controls that scope every read and write to your workspace.
Signed, idempotent webhooks for payments and bookings.
Send guardrails built in, including suppression of bounced and unsubscribed addresses.
Vendors with clear data-protection terms.

2. Your mailbox

ExtrovertAI only sends email from your mailbox. It never reads, scans, polls, or monitors your inbox. There are two ways to connect:

Gmail and Google Workspace connect through Google’s official sign-in (OAuth). We never see your Google password. We ask for one Gmail permission, gmail.send, plus your email address to identify the mailbox. That permission lets us send the emails you approve and nothing else: we cannot read, search, delete, or change your messages. Google returns an access token and a refresh token, which we encrypt with AES-256-GCM before they touch the database.
Any other mailbox (Zoho, GoDaddy, Fastmail, a custom domain, and so on) connects over SMTP with the server details and password you provide. The password is encrypted with AES-256-GCM at rest and used only to send the emails you approve. An optional IMAP connection is used for one thing: placing a copy of each sent email in your own Sent folder. We never use it to read mail.

Outlook one-click sign-in is coming soon.

Replies go straight to your own inbox, like any normal email. If you want them reflected in ExtrovertAI, you log the outcome yourself in one click, or paste a reply in to get a drafted answer. When you disconnect a mailbox we delete its tokens or password; nothing lingers. We do not archive your mail and we do not use mailbox data for advertising or for training AI models.

3. Data protection

Concrete controls that apply to every workspace:

All traffic is served over TLS.
Database access is scoped by row-level security. A read or a write that is not for the current workspace never leaves the database.
Payment card details are handled by Stripe and never sent to our servers.
Signed webhooks (payments, bookings) are verified for signature and idempotency before we accept them, so a replayed or forged request cannot affect your account.
Secrets (API keys, encryption keys, database credentials) live in a managed secrets store, are rotated on a schedule, and are only injected into the services that need them.

For collection, retention, rights, and international transfers, see the Privacy Policy.

4. Where your data lives

Application data (accounts, workspaces, drafts, sent messages, replies, and suppression lists) is stored in a managed Postgres database. Background jobs run through a managed Redis instance. Static assets are served from a global CDN. The specific region hosting your data is documented in the account settings; on request we will confirm the exact region for your account in writing. Subprocessor regions are available on request. Cross-border processing is governed by the safeguards in the Privacy Policy.

5. Deliverability and compliance

Cold outreach fails in the spam folder. It also fails legally when it hides the sender or ignores the recipient. ExtrovertAI treats both problems as security problems and defends against them by default:

Paced sending. Sending is paced to protect your mailbox and domain. No batch blasts.
Bounce suppression. An address the recipient's server rejects when we send is blocked automatically. A bounce that arrives in your inbox later takes one click to log, and that address is blocked too.
One email per lead. No automated follow-up chains, and nothing sends until you have read and approved it.
One-click unsubscribe. Every message carries a working unsubscribe token. Suppression is instant and account-wide.
Physical address. Every message carries your business name and mailing address, meeting CAN-SPAM and equivalent requirements.

6. Infrastructure and access

The service runs on managed cloud infrastructure with hardened defaults.
Production access is limited to a small, named group of maintainers, is two-factor protected, and is logged.
Dependencies are patched on a routine cadence; critical fixes ship faster.
Application, database, and job-queue errors are monitored and alerted so incidents surface quickly.

7. Vendors

We use a small set of established vendors to run the service. Each is bound by data protection terms and receives only the data it needs. Business customers can review the subprocessor list or request it with a Data Processing Agreement.

8. Certifications and audits

ExtrovertAI is an early-stage product built by a small team. We do not currently hold a SOC 2 report, an ISO 27001 certificate, or an equivalent third-party audit. What we do instead is publish the controls we actually run (this page), name every subprocessor, and offer a Data Processing Agreement to business customers who need one. If you have specific compliance requirements before you can adopt the product, please write to us at contact@stallwart.in and we will tell you honestly what we can and cannot meet today, and where a certification sits on our roadmap.

9. Operations

Backups run on a routine schedule and are restored on a test cadence.
Incidents that materially affect customer data trigger a written postmortem and a customer notification, within the timelines required by applicable law.
We are a small, deliberate team. We prefer fewer moving parts and boring technology to feature spam.

10. Vulnerability disclosure

If you believe you have found a vulnerability, please email contact@stallwart.in with a description, steps to reproduce, and the impact you observed. Please give us reasonable time to investigate and fix the issue before you make it public. We will acknowledge your report within three business days and keep you updated as we work through it.

We ask that researchers:

Do not access data that does not belong to them.
Do not run denial-of-service tests or spam our recipients.
Give us a reasonable window to remediate before disclosing publicly.

Good-faith researchers who follow these rules will not be pursued under computer-misuse laws.

11. Contact

Security questions: contact@stallwart.in. For privacy and data-subject requests, see the Privacy Policy. For the rules that govern your use of the service, see the Terms of Service.