Security

Last updated: 1 October 2026

Gofuso Zero is security-reviewed every week. Each review checks the live service, the database and the server functions. Findings are recorded, prioritised and fixed on a rolling basis, and this page is updated whenever what we do changes.

This page explains, in plain terms, how we protect your data, your mailboxes and the accounts you connect. We treat security as ongoing work rather than a one-off exercise, and we describe only what is in place today.

Your data

Encrypted in transit. Every connection is encrypted with TLS 1.2 or higher (TLS 1.3 where your browser supports it). Plain HTTP is redirected to HTTPS, and HTTP Strict Transport Security tells browsers to only ever reach us over an encrypted connection.
Row-level data isolation. The database enforces Row-Level Security on every table, so one account can never read another account's data. Anyone who is not signed in is refused access to account data.
Tokens encrypted at rest. The long-lived tokens for your connected accounts, and any AI provider key you add, are encrypted with AES-GCM before they are stored, on top of the database's own encryption at rest.
Your connected-account tokens stay on the server. When you connect Podio, Gmail, Outlook, Microsoft Teams or Google Chat, the sign-in completes on our server and the long-lived refresh token never reaches your browser. The app is given a short-lived access token, held in memory only while the page is open and never saved to your device.
Disconnecting removes our access. When you disconnect an account, we delete the token we stored for it. For Outlook and Microsoft Teams, to remove Gofuso Zero from your Microsoft account entirely, revoke it under app permissions in your Microsoft account settings.
No private keys in the page. No private API keys or high-privilege credentials are ever sent to the browser. The only key in the page is a public one, and everything it can reach is limited by Row-Level Security.

Defence in depth

Content Security Policy. A Content Security Policy is enforced in production, restricting which domains scripts, styles and connections may come from. Inline scripts are currently still permitted for compatibility, and removing this is on our security plan.
Hostile content neutralised. Email HTML is cleaned with the industry-standard DOMPurify library and then shown inside a sandboxed frame that cannot run scripts. Chat messages and Podio content are shown as plain text or rebuilt from a short allow-list of formatting tags, with every other tag and attribute removed.
Clickjacking blocked. The app refuses to be embedded in other websites, preventing overlay and click-hijacking attacks.
Controlled supply chain. Third-party libraries are hosted by us, locked to an exact version and checked with a Subresource Integrity hash, so a tampered or swapped script simply will not load.
Hardened HTTP responses. MIME-sniffing protection, a strict referrer policy and a restrictive permissions policy are applied to our pages.
Account controls. Suspended or lapsed accounts are blocked on the server, not just in the app, so they cannot fetch new connection tokens.

Reporting a concern

If you believe you have found a security issue, please email hello@gofuso.com. We will acknowledge your report and keep you updated until it is resolved.