Security Architecture
Sep 23, 2026 · Security
6 min read
Your data is processed with a privacy-first architecture designed to keep control in your hands at every layer. We don't build behavioral profiles. We don't train AI on your personal content. We don't use your data for advertising.
"We are intentionally strict about data usage boundaries. We never sell your data, never build cross-user profiles, and never train machine learning models on personal inbox content."
How Your Data Is Handled
We only process the minimum data required to power your feed experience.
Email & feed sources:
- We only read the Promotions and Updates categories of a connected Gmail account, plus Social if you turn it on.
- We ignore primary inbox content entirely.
- We process metadata such as sender, subject, and timestamps to organize your feed.
- Optional AI features, such as Auto Tagging, stay off until you turn them on, and only ever receive public information about a source — never your emails. See the Privacy Policy.
Content Storage Modes
Depending on your deployment (Cloud vs Community Edition), data is handled differently:
Privacy Mode
- The only mode on Neuplace Cloud
- Email bodies are never written to our database, only cached briefly (up to 15 minutes)
- Content is fetched securely from Google APIs on demand
Performance Mode
- Available in the upcoming Community Edition
- Newsletter content is stored locally for instant loading
- Storage optimized for your own private hardware
Authentication & Token Security
Credentials are never stored in a readable form:
- Google authorization tokens are encrypted before they are stored.
- Passwords are kept only as one-way hashes.
- No credential is ever stored in plain text.
Multi-Layer Security Safeguards
All network traffic is encrypted in transit with HTTPS/TLS.
SSRF protections are strictly enforced for external RSS feed fetching.
Access to production systems is limited to the people who operate Neuplace.