Your mailbox
- Reach never sees your Gmail password. Sending goes through a scoped access grant you can end at any time.
- Reach only sees the threads it started, never the rest of your inbox.
- Nothing is sent until you approve it.
Your data
- Encrypted in transit (TLS) and at rest. Access grants and calendar tokens get a second layer of AES-256-GCM encryption.
- Every workspace is isolated by row-level security in the database, so one customer's query cannot read another's rows.
- Encrypted daily backups, kept 35 days, with a copy in a second region.
- Deleting a workspace, a person or your account takes effect at once, and you can download your data at any time.
Your account
- Sign in with a one-time code sent to your email, or with Google. No passwords to leak.
- Risky actions, such as deleting data or forgetting a person, ask you to confirm it is really you.
Our infrastructure
- Runs on AWS in private networks, behind Cloudflare. Production secrets live in a managed secret store, never in code.
- Service logs are kept for a year for investigations, and we avoid writing personal data into them.
- Our full list of subprocessors is in the Privacy Policy.
Found something?
We would love to hear from you. Email security@reachcrew.app with the details and we will get back to you quickly. Please give us a fair chance to fix it before sharing it publicly.