Security

The design decision that matters most

Followthrough does not store your email. Our backend reads recent messages to work out which conversations are waiting on a reply, processes them in memory, and keeps only identifiers and timestamps — Gmail's own message and thread IDs, when something was sent, and which conversations you chose to track.

There is no database of your message bodies or subject lines, because we never write them down. If our database were exposed tomorrow, the contents of your email would not be in it. Most of our security posture follows from that one decision, and we intend to keep it.

Access to your mailbox

• We request one Google permission, gmail.readonly. It is read-only — Followthrough cannot send, delete, or alter your mail.
• We never see or handle your Google password. Authentication happens on Google's consent screen.
• The refresh token that keeps your connection alive is held in an encrypted secret store, not in an ordinary database column.
• You can disconnect from the extension, or revoke access in your Google Account settings, at any time. Either stops our processing.

Infrastructure

• Data is encrypted in transit using TLS, and encrypted at rest by our hosting providers.
• The application runs on Supabase (managed Postgres and edge functions). Database access is constrained by row-level security so one account cannot read another's rows.
• Gmail change notifications arrive through Google Cloud Pub/Sub. We verify that push requests genuinely come from our own service account before acting on them.
• The marketing site is served by Cloudflare.
• Requests to our public endpoints are rate limited to blunt abuse and automated scanning.
• Our full vendor list is on the Subprocessors page — three companies, all named.

Engineering practice

• Changes go through version control and automated tests and type checks run on every change.
• Production secrets are held in managed secret storage, not in source code.
• Access to production is limited to people who need it — today, a small founding team.

What we have not done yet

We hold no security certifications at this time. Specifically, Clarivo is not SOC 2 audited, not ISO 27001 certified, not HIPAA-compliant, and not PCI DSS assessed. We do not run a paid bug bounty programme, and we have not commissioned an independent penetration test.

Followthrough is not intended for protected health information, payment card data, or other regulated categories, and you should not use it for them.

As a condition of Google's verification for restricted API scopes, applications like ours undergo an independent security assessment. We are working through that process ahead of general availability. If you need a certification we do not yet hold, please talk to us about your timeline rather than assuming — we would rather tell you no than surprise you later.

Reporting a vulnerability

If you find a security problem, please tell us at [email protected] before disclosing it publicly, and give us a reasonable chance to fix it. We will acknowledge your report, keep you updated, and credit you if you would like. We will not pursue legal action against researchers acting in good faith under this policy.