Security
Where your mail lives, and who can read it.
Email is the most personal data a product can hold. Here is where ours sits, how it is protected, how long it is kept, and what we have and have not been certified for.
01 · Compliance
GDPR today. SOC 2 next.
- GDPR
- Compliant
- Pidgeon is PCN Labs OÜ, an Estonian company, and processes your data as your processor under a data processing agreement that applies automatically, with nothing to sign.
- SOC 2
- Coming soon
- We do not have a SOC 2 report yet. If your review needs one, tell us when — it helps us plan the audit.
- Subprocessors
- Listed in full
- Every company that touches your data, what it does with it, and the region it does it in.
02 · Where it lives
Stored and processed in the EU.
Your mail is stored and processed in the EU (Ireland); mail clients connect through London. Each piece, and where it runs:
- Ireland
- Receiving, sending and the raw originals of your messages run on Amazon SES and S3 in the EU (Ireland) region.
- Application
- Ireland
- The API and the web app run on Vercel, pinned to its Dublin region.
- Database
- European Union
- Accounts, messages and their metadata are held by Supabase in the European Union.
- Mail clients
- London
- The IMAP and SMTP service your mail apps connect to runs in London. The encrypted connection is opened at the network edge nearest the mail app, which can be outside the EU.
03 · How it is protected
Encrypted, scoped, and logged.
- In transit
- TLS, everywhere
- Between your code and the API, between mail servers where they support it, and between our own services.
- At rest
- Disk and object storage
- Encrypted at rest, with a customer-managed KMS key on the bucket that receives your mail. Message bodies are not encrypted again inside the application: your code reads them as plain text over the API, and search needs to read them too.
- Keys
- Narrower, never wider
- An API key can be scoped to one address and one level of access, can only create keys narrower than itself, and takes its descendants with it when it is revoked.
- Mail clients
- One password per mailbox
- IMAP and SMTP use app passwords scoped to a single mailbox, never your API key.
- Inbound mail
- Read before your agent
- Pidgeon Firewall marks every inbound message that tries to instruct the agent reading it.
- Audit
- 90 days of events
- Every event is written to a log you can read and replay, kept for 90 days, and cannot be deleted earlier.
04 · How long it is kept
Until you delete it, or sooner.
- Messages
- Until deleted
- Or for as long as your workspace’s own retention policy says, from 1 day to 10 years. Deleting a message deletes its raw original too.
- Raw originals
- 30 days
- The message as it arrived, kept for 30 days so a parsing problem can be fixed.
- Your account
- Erased on request
- Closing your account erases its data, overriding every window on this page. An encrypted backup taken before then keeps it until that backup rotates out.
05 · Report a problem
Found something? Tell us first.
- Privacy and data
- privacy@pidgeon.ai
- Access, export or deletion requests, and anything a regulator would ask.