Your security is our priority
We take security seriously. Here is what we have implemented to protect your data and what is on our roadmap.
What We Have Built
These security features are live and protecting your account today.
Google CASA Tier 2
Icebox passed Google's Cloud Application Security Assessment (CASA) Tier 2, the review Google requires before an app may access Gmail.
Where AI runs
Sorting and drafting run through Google's Gemini API. On the paid API, Google does not use your email to train its models. Icebox never sells your data, and nothing is sent without your approval.
Encrypted mailbox access
The OAuth tokens and IMAP passwords that connect your mailbox are stored encrypted. You can disconnect a mailbox at any time.
Secure Authentication
JWT-based authentication with access and refresh tokens. Your sessions are securely managed with automatic token refresh.
OAuth 2.0 with PKCE
Sign in with Google or Microsoft using OAuth 2.0 with PKCE (Proof Key for Code Exchange) for maximum security against interception attacks.
Magic Link Authentication
Passwordless login option via secure email links. No password to remember or steal.
HTTPS Everywhere
All communications between your browser and our servers are encrypted using HTTPS/TLS.
Secure Password Reset
Token-based password reset flow with expiring links to ensure only you can reset your password.
XSS Protection
Built-in protection against cross-site scripting attacks with content sanitization.
Current Security Practices
How we protect your data every day.
- All API endpoints secured with HTTPS
- CSRF protection on OAuth flows
- Automatic session invalidation on logout
- Secure token storage practices
- Input validation and sanitization
- Regular security updates and patches
Questions or concerns?
Our team is here to help. Reach out for security questions or to report a vulnerability.