Last updated: 10 September 2026
Connecting a mailbox to a third party is a real decision, and it should be made on evidence rather than reassurance. This page describes the controls we operate. Where something is planned rather than in place, it says so.
Credentials and tokens
- Signerva never asks for your email password. Access is granted through Google's OAuth flow and can be withdrawn by you at any time.
- OAuth refresh tokens are encrypted at rest using a key held outside the application database, so obtaining a copy of the database is not by itself enough to read anyone's mail.
- Tokens exist only on our servers. They are never sent to the browser, never embedded in a page, and never written to logs.
- When you revoke access — in Signerva or in your Google account — the token is destroyed and syncing stops.
Tenant isolation
Signerva is multi-tenant. Every record carries the workspace it belongs to, and access is enforced in two independent places: row-level security policies in the database, and authorisation checks in the application. A bug in one is not sufficient to expose another workspace's data.
Encryption and storage
- All traffic is encrypted in transit using TLS.
- Data is encrypted at rest by our infrastructure provider.
- Customer data is stored in the European Union (Supabase, eu-central-1).
- Backups are encrypted and retained on a rolling 35-day window.
What we do not log
Application logs, error reports and performance traces are configured to exclude message bodies, subject lines and participant addresses. This is deliberate: diagnostic tooling captures request payloads by default, and email is exactly the payload that must not be captured.
Controls on email actions
The most consequential thing this product can do is send email. Every action Signerva takes falls into one of four states, and the state is recorded, not implied:
| State | What it means |
|---|---|
| Suggestion | Signerva thinks something is worth your attention. Nothing has happened. |
| Draft | Text has been written for you. It has not left your account. |
| Approved action | You reviewed something and told Signerva to do it. |
| Automated action | A rule you configured acted on your behalf, within the limits you set. |
Auditing
Every consequential action — a send, a reply, an archive, a bulk operation, a rule firing, a connection change — is written to an append-only audit log recording who or what acted, the thread it acted on, the time, the action, and whether it succeeded or why it failed. Workspace administrators can read and export it. Records are retained for 12 months.
Our own access
Signerva staff do not read customer email. Access to production data is restricted, requires a business reason, and is itself logged. If diagnosing a problem genuinely requires looking at a specific message, we ask you first and record that we did.
Independent assessment
Applications that access Gmail data under Google's restricted scopes must pass an annual independent security assessment (CASA) conducted by a Google-authorised assessor, in addition to Google's own OAuth verification. Signerva is subject to both, and maintains them for as long as the product operates.
Reporting a vulnerability
If you believe you have found a security issue, please write to security@signerva.com with enough detail to reproduce it. We will acknowledge within two business days and keep you updated until it is resolved. We will not pursue legal action against anyone who reports a genuine issue in good faith, gives us reasonable time to fix it, and does not access or modify data belonging to other people.