ISO 27001 in progress
BACKED AND USED BY PEOPLE FROM
01
Encrypted at every level
All data is encrypted in transit and at rest. Services communicate over mTLS. Encryption keys are managed separately and rotated regularly.
02
No external model training
Your email is never used to train external AI models. We’ve locked this down contractually with every AI provider we use, and your data is processed to help you.
03
Enterprise-grade from day one
Security is not a feature we added later. It was the first architecture decision we made. Before there was a product, there was a security architecture.
Access to someone’s inbox is the greatest trust you can give software. Every technical decision we make passes through one filter: does this deserve the trust our users place in us?
Data residency in the EU
All data is processed and stored within the European Union. No exceptions. No transfers to third countries.
Minimal data storage
We retain only what is necessary for the product to work. No shadow copies. No unnecessary retention. Delete your account, and we delete everything.
Access control and audit logs
Strict role-based access control within our team. Every access to production data is logged. No one can access your inbox unless it is strictly necessary for support, and only with your permission.
GDPR-compliant by design
We comply with the GDPR and test our security with a yearly external pentest. You can wipe your data from your settings at any time, and we follow a fixed protocol in the unlikely event something goes wrong.
Responsible disclosure
We maintain a responsible disclosure policy. Security researchers who report vulnerabilities are taken seriously and treated professionally.
Most startups begin ISO 27001 after their first enterprise customer asks for it. We started the process before we launched. Because we believe a company with access to your communication has no room for “we will get to that later.” We expect to complete certification in the coming months. Not because a customer demands it. Because it is the only way to earn the trust we are asking for.
Most privacy pages are written to provide legal cover. This page is written to be clear.
We make money because you pay for our product. Not by selling your data. Not by building your profile. Not by showing ads. You are our customer, not our product.
Your email contains your business relationships, confidential conversations, contracts, and personal communications. We are aware of that every day. And we build our product as if it were our own inbox.
~ The Pigion Team