Security & Trust

This page explains how Maybole protects data, where it lives, who we share it with, and how to report a security issue. We describe what we actually do today and are honest about what we do not yet have.

Encryption

• In transit: all traffic is served over HTTPS/TLS by our hosting platform (Vercel).
• At rest: passwords are stored only as bcrypt hashes (cost 12) — we never store or see your password. Sensitive connected-mailbox tokens are encrypted with AES-256-GCM. Password-reset and email-verification tokens are stored only as single-use, expiring SHA-256 hashes. Database storage-level encryption is provided by our database platform (Neon).

Access control

• Application data is isolated per user; you can only access your own account’s data.
• Administrative access is limited to an explicit allowlist of operator accounts.
• Login is rate-limited to resist brute-force and credential-stuffing; account email actions (registration, password reset) are rate-limited too.
• Authentication: email + password today. Multi-factor authentication is not yet offered — it is on our roadmap.

The self-run mailbox model

For sending outreach, Maybole does not send mail from our servers and does not hold your mailbox password. Drafts are generated for you, and you run a small tool on your own Google or Microsoft account that creates the drafts there. Your draft feed is protected by a personal access token that authenticates by itself, does not expire automatically (it stays valid until you regenerate it), and grants read access to your unsent drafts and their recipient addresses. You can regenerate it any time, and we can disable it if abuse is detected.

Payments (PCI)

All card payments are handled by Stripe via Stripe-hosted checkout. Card numbers never touch our servers; we store only Stripe customer/subscription identifiers. We rely on Stripe’s PCI DSS Level 1 compliance.

Artificial intelligence

We use Anthropic’s Claude to parse an uploaded résumé and to write first-draft outreach emails. Every AI request is made by our servers over an encrypted connection using our own secured API key — your browser never sends data to Anthropic directly. We send only what the task needs and never send passwords or card data. Anthropic does not train its models on data submitted through its API. AI output can be inaccurate, so drafts are never sent automatically — you review, edit, and send each one. See the Privacy Policy §5 for detail.

Subprocessors

We share data only with the providers required to operate Maybole:

We keep this list current and update the “Last updated” date when it changes.

Data retention & deletion

Registered users can permanently delete their account and all associated data at any time from the Account page. You can also email tech@maybole.ai to request access or deletion. Deletion removes your data from the active database; copies in routine backups age out on the backup cycle.

Incident response

If we discover a security incident affecting personal data, we will investigate, contain it, and notify affected users and any required authorities without undue delay.

Certifications

We do not currently hold a SOC 2 or ISO 27001 certification. We build on infrastructure providers (Stripe, Vercel, Neon) that maintain their own certifications.

Reporting a vulnerability

If you believe you have found a security issue, please email tech@maybole.ai. We welcome responsible disclosure and ask that you give us a reasonable opportunity to fix the issue before disclosing it publicly.