Security
How we look after your email
This page describes how 320px protects your email and account today. We don’t hold a security certification, so we name none.
Signing in
Your password is held by our sign-in service as a hash, never as readable text. Sign-in attempts are limited by connection, to slow down guessing.
Connections
320px is served only over HTTPS, and browsers are told to keep using HTTPS for a year. Every page sends a strict content security policy, and no other site can show 320px inside a frame.
Who can read your email
Each person reads only the mailboxes assigned to them, workspace owners included. The database itself enforces this for each workspace and each mailbox, not only the app.
Emails you open
An email’s own HTML is shown in a sandboxed frame with an origin of its own, so it can’t reach your account. We don’t load images that look like tracking images, and in Settings you can choose to be asked before any image loads.
What generated text can do
Summaries, briefs and answers are shown with links to the emails they came from. Nothing generated is sent, archived or deleted for you.
Payments
Card details go straight to Stripe, at checkout and in the billing portal. 320px never receives your card number. It keeps the card’s brand and last four digits to show the workspace owner.
Backups and deletion
Encrypted backups are kept with Hetzner in Falkenstein, Germany: 7 daily, 4 weekly and 12 monthly snapshots. Before a workspace or profile is deleted, a deletion record is saved off our servers, so the data is removed again if a backup is ever restored. The data and retention page has the details.
Services that process data for us
| Service | What it does | What it receives |
|---|---|---|
| Anthropic | Summaries, topics and items, related emails, area briefs and answers | Email text |
| OpenRouter and the model providers it routes to | Each email’s area, and search by meaning | Email text |
| Hetzner | Encrypted backups, in Falkenstein, Germany | Encrypted copies of the data |
| Cloudflare | Checks that 320px is reachable, and keeps deletion records | No email content: a workspace identifier or a hashed profile identifier |
| Stripe | Checkout, card payments, invoices and tax | The workspace owner’s name, email address, billing address and card |
| Reach Out | Page views on the public pages, for visitors who aren’t signed in | Page addresses and campaign tags, without personal details |
Our own mail service receives and sends your email. The privacy notice explains what each service does with the data.
Reporting a problem
If you find a security problem, email hello@reachoutlabs.ch with what you found and how to see it.