How AfterHours Protects Your Inbox Data

The most secure data is the data we never touch. AfterHours exists to do one narrow job: spot a brand-new sales lead that arrives outside business hours and send a fast, on-brand reply. So we ask for the minimum permissions that job requires and nothing more.

• We request only gmail.readonly and gmail.send (and the Microsoft Graph equivalents) — not full mailbox management, not your contacts, not your settings.
• Personal, financial, and otherwise sensitive emails are filtered out before processing. We never read, store, or display them.
• Lead emails are processed in a short, in-memory window to classify the message and draft a reply — not warehoused for later mining.

To reply on your behalf, we hold an OAuth refresh token for your connected inbox. That token is the crown jewel, so we treat it like one. Every token is encrypted with AES-256-GCM — an authenticated encryption scheme that both hides the data and detects any tampering — before it ever reaches our database. The encryption key lives only in the runtime environment, never in our source code, and the application refuses to start in production if a strong key isn’t present.

All traffic to and from AfterHours runs over TLS (HTTPS). We add a strict set of security response headers — HSTS, content-type and framing protections, and more — so browsers enforce safe behavior. Our cross-origin policy is locked to our own frontend rather than left open to the world.

Anyone can claim their app is secure. Because AfterHours uses a Google “restricted” Gmail scope, we’re required to prove it. Google mandates an independent CASA (Cloud Application Security Assessment) Tier 2 review, carried out against the OWASP ASVS (Application Security Verification Standard) — the same benchmark used across the security industry.

That assessment looks at how we handle authentication, encryption, data storage, dependencies, and more, and it’s validated by an authorized third-party lab — not by us. We’re completing this assessment as part of Google’s OAuth verification, and it’s repeated every single year, so our security posture is re-checked on an ongoing basis rather than once and forgotten.

Preparing for CASA isn’t a paperwork exercise — it’s engineering. Recent work included:

• Adding industry-standard security headers across every response.
• Continuously scanning our dependencies for known vulnerabilities and removing or patching anything flagged.
• Failing closed: the app won’t boot in production without a strong encryption key and session secret.
• Stripping all debugging and test endpoints out of production builds entirely.

You should never have to take a vendor’s word for it. With AfterHours, inbox access is minimized, your credentials are encrypted, and our security is verified against a public standard by an independent lab — every year. That’s the level of care your customer conversations deserve.

Connect your inbox securely →