Skip to content

Policies

Security overview

Last updated: 18 September 2026

Where your data lives

doublestack runs on cloud infrastructure in EU regions. Sub-processors are listed on the Sub-processors page.

Encryption

  • In transit: modern TLS for everything between you and doublestack, and between our services and any sub-processor.
  • At rest: strong industry-standard encryption for stored data.

How we handle inbox content

doublestack reads email from the Microsoft 365 inbox connected to each user’s account. We do not keep email content (subject, body, attachments) as a record, and we do not index it. We store it only temporarily and encrypted.

The user’s tone-of-voice profile is the one place email text is kept longer. It holds excerpts of the user’s own sent emails and their signature, encrypted, until the profile is rebuilt or the account is deleted.

What’s persisted from the inbox is what you’d expect: buyer profiles, sender classifications stored as hashes, and the user’s tone-of-voice profile. These are stored with the same controls as any other customer data on the platform.

The full picture of what we do and don’t store from your inbox is in the Privacy Policy.

Authentication

You sign in with Microsoft 365. We don’t store passwords. Multi-factor authentication is handled by Microsoft.

Access control

Access to customer data on the production side is restricted to staff who need it for their job. Access is logged. Every elevation is auditable.

No engineer reads your content for fun, for product research, or to train models. The only reasons we look at customer data are:

  • You ask us for help, and we need to see what you’re looking at
  • We’re investigating a bug or incident that requires it
  • The law requires it

We log and review the access request.

Backups

We back up your data daily. Backups are encrypted at rest to the same standard as our production database. Daily backups are retained for 35 days, and additionally, we support point‑in‑time recovery over a rolling 7‑day window.

After cancellation, your data ages out of all backups within 35 days of deletion.

Monitoring and incidents

We monitor the service continuously for availability and security signals.

If a security incident affects your personal data, we will notify you without undue delay and, if possible, within 24 hours of becoming aware.

See the Data Processing Agreement for the details of breach notification.

Vendor security

Our current sub-processors are listed on the Sub-processors page. They are major operators with their own published security commitments. We review them when we add a sub-processor and revisit periodically.

What we ask of you

Security is shared. Help us by:

  • Keeping your Microsoft account secure (strong password, MFA on, devices up to date)
  • Removing access for staff who leave
  • Not sharing logins
  • Reporting anything suspicious to security@doublestack.app

Reporting a vulnerability

If you find a vulnerability in doublestack, write to security@doublestack.app. Include enough detail for us to reproduce it. We respond within two working days, fix what we can, and credit you if you want credit.

We don’t run a bug-bounty programme yet. We do appreciate the work.

Contact