For EU and US teams
One set of controls for customers on both sides of the Atlantic. The application, its databases and backups run in GDPR-protected data centres, and prices are in US dollars.
Security and compliance
Your mailboxes and data, kept safe in the EU and US.
Short answerRoxInbox keeps mailbox credentials in a dedicated encrypted vault, acts only on its own warm-up messages, protects customer data to GDPR standards, and gives every customer a data processing agreement. The same controls apply to teams in the EU and the US.
Encrypted credential vault
Mailbox passwords, app passwords and OAuth tokens are stored in a dedicated encrypted vault, separate from application data, with key rotation. Staff cannot read them.
Least-privilege access
Microsoft 365 mailboxes connect through OAuth, so you can revoke access from your own admin console at any time. Disconnecting a mailbox deletes its credentials.
Warm-up messages only
RoxInbox identifies and acts on its own warm-up messages. It does not read, export or change the rest of your mailbox, and never sends your campaign content into the network.
A DPA for every customer
A data processing agreement applies to every customer automatically, with 48-hour breach notice, a published subprocessor list and GDPR Article 28 terms that most US security reviews accept as a baseline.
Know your customer
Paid accounts are verified, spam rates are monitored, and senders who break the acceptable-use policy are removed, which protects the network your reputation depends on.
Controls
What we do, in detail.
Data protection
- Encryption in transit (TLS) and at rest for databases and backups.
- Credentials and tokens in a separate encrypted vault with key rotation.
- Customer data separated by account; warm-up network segments isolated from each other.
- Deletion of credentials on disconnect, and of customer data within 30 days of termination.
Access
- Role-based, least-privilege access for staff, with multi-factor authentication.
- Security-relevant events logged and monitored.
- Confidentiality undertakings for everyone with access.
Abuse prevention
- Verification of paid customers before mailboxes join the network.
- Monitoring of spam rate, bounces and blocklist listings, with automatic pauses.
- A public Acceptable Use Policy and an abuse desk at welcome@roxinbox.io.
Certifications
RoxInbox does not hold a SOC 2 or ISO 27001 certification today. We will publish any certification here once it is issued, and not before.
FAQ
Security questions
Where is RoxInbox data stored?
In GDPR-protected data centres in the European Union, for EU and US customers alike. Customer personal data is not transferred outside the EEA unless a subprocessor requires it, and then only with an adequacy decision or Standard Contractual Clauses in place.
Can RoxInbox staff read my email?
No. Credentials are held in an encrypted vault that staff cannot read, and the Service only acts on its own warm-up messages. Support staff see mailbox status, placement results and settings, not message content.
Can US companies use RoxInbox?
Yes. RoxInbox serves teams in the US and the EU with the same product, security controls and data processing agreement, and prices are in US dollars. RoxInbox does not hold a SOC 2 certification today; we will say so here when that changes.
Is email warm-up legal under the GDPR?
Yes. Warm-up messages are exchanged between participating mailboxes whose owners have agreed to it, so they are not unsolicited marketing. Personal data involved is limited to addresses, message metadata and warm-up content, and is covered by the DPA.
How do I report a security issue?
Email welcome@roxinbox.io with the details. Please do not test against other customers' data or disrupt the Service. We will reply and keep you updated on the fix.
Questions from your security team?
Send them over. We'll answer your security questions and questionnaires.