How Vibepax handles access to your mailbox
Vibepax is given access to mailboxes that businesses depend on. This page says exactly what that access is and how it is protected.
Mailbox permissions
Connecting a mailbox uses the OAuth authorization code flow with PKCE. Vibepax requests the permissions below, together with the basic sign-in permissions (openid, email, profile) that identify the account being connected.
| Permission | Provider | Used for |
|---|---|---|
gmail.send | Google Workspace | Sending your sequences |
gmail.metadata | Google Workspace | Reading message headers to detect replies, bounces, and automatic replies |
Mail.Send | Microsoft 365 | Sending your sequences |
Mail.ReadBasic | Microsoft 365 | Reading message properties without the body, to detect replies and bounces |
offline_access | Microsoft 365 | Keeping the connection without asking you to sign in again |
Permission to read message text is optional, requested separately, and recorded with the date and the version of the consent text.
Authorization tokens
- Each token is encrypted with its own data key, and that key is encrypted by a key held in a key management service.
- A token is bound to its mailbox and organization. Copied to another record, it cannot be decrypted.
- The service that answers your browser cannot decrypt tokens. Only the services that send mail and read replies can.
- Tokens are never sent to the browser, put in a URL, or written to logs.
- Disconnecting a mailbox erases its token, and revokes it at the provider where the provider allows that.
Separation between customers
Every record belongs to one organization, and the database itself enforces that with row-level security. A query that runs for one organization cannot return another's rows, even if the application code has a mistake. Automated tests attempt cross-organization access on every endpoint and must fail.
Sign-in
- Sign-in uses your Google Workspace or Microsoft 365 account, or a work email address with a password. Passwords are checked by Firebase Authentication, a Google service. Vibepax's own servers never receive them.
- Personal accounts and addresses at free-mail providers are rejected. An address used with a password has to be confirmed first.
- Sign-in sits behind a bot challenge and rate limits by IP address and by account.
- The session is an opaque cookie that scripts cannot read, sent only over HTTPS.
What is stored
Stored
- The contacts you import
- The templates you write
- Facts about each send: time, mailbox, contact, and result
- An audit trail of changes in your organization
Not stored
- The text of mail you receive
- Rendered copies of mail you send
- Mailbox passwords
- Open events
Links in your mail
Unsubscribe and tracking links use random tokens and contain no personal data. Unsubscribing happens when the recipient presses a button on the page, not when the link is opened, so automated scanners cannot unsubscribe anyone by accident.
Where data is kept
The application servers and the database run in the European Union, in Frankfurt. The website is delivered through Cloudflare's network, and sign-in is handled by Firebase Authentication, a Google service.
Reporting a vulnerability
A contact address for security reports will be published here before launch.