Security

This is an English translation for your convenience. The German version is legally binding.

Email is some of the most sensitive data there is. This page says precisely how Routira protects it: where it's stored, what's encrypted and by whom, who can access it, and what we don't have yet. No badges we haven't earned.

Where your data lives#

Your mail is stored in the EU. It leaves the EU when an AI feature processes it at OpenAI, and when you turn on notification previews on an Apple device. Several of our providers are US companies, even where they store data in the EU; transfers rely on the EU Standard Contractual Clauses and, where available, the EU-U.S. Data Privacy Framework. The full list is on the subprocessor page.

Encryption#

• In transit. Every connection to Routira uses TLS, and the web app sends HSTS. Routira connects to your mail provider only over encrypted connections (TLS 1.2 or newer, with the certificate checked); unencrypted connections are refused.
• At rest. Our database and our object storage are encrypted at rest by their providers.
• By Routira. Routira itself encrypts original messages and attachments before storing them (AES-256-GCM, with a key per workspace). Mailbox passwords are encrypted with a key of their own for each mailbox (envelope encryption). When you disconnect a mailbox, the key of its password is destroyed.
• What Routira doesn't encrypt itself. Message text, metadata (such as sender, subject and date) and what Routira derives from your mail are stored in the database so that Routira can show, search and sort them. They're protected by the provider's encryption at rest and by our access controls, but not additionally by Routira.
• Our master key. The keys above are in turn encrypted with a master key, which is kept as a protected secret in our hosting environment. It isn't in a hardware security module yet.
• Not end-to-end. Routira has to read your mail to show, search and sort it. We don't claim otherwise.

Reading mail safely#

Before a message is stored, Routira removes scripts, forms and other active content, and blocks images and other content that would load from the sender's servers, so senders can't see when you open a message. If you choose to load a message's images, your device fetches them directly from the sender's server, which then sees your IP address and when you opened the message. Messages are displayed in a sandbox in which scripts don't run. The app can't be embedded in other websites.

Signing in and access#

• A code instead of a password. You sign in with a six-digit code we email you. It's valid for 10 minutes, allows five attempts and is stored only as a hash. A session ends after 30 days without use, or when you sign out.
• Access is checked on every request. Every request is checked against your workspace and your rights. Shared mailboxes have the rights Viewer, Member and Manager. Security-relevant actions in a workspace are recorded in an audit log.
• Our own access. Only Michael Ketzer has access to Routira's production systems, protected by strong authentication. We look at the content of your mail only if you ask us to in a support case, or if it's necessary to investigate a security incident or to comply with a legal obligation.

AI and your data#

The AI features use OpenAI. Routira sends only the text each task needs. Storage of requests at OpenAI is switched off, and neither OpenAI nor we use your mail to train AI. OpenAI may keep requests for up to 30 days to detect abuse. AI requests are processed in the USA. In team workspaces, admins can switch the AI features off for the whole workspace; mail from such a workspace isn't sent to OpenAI. Personal workspaces and single mailboxes can't do that yet. More in the privacy policy.

Backups and availability#

Our database provider keeps a restore history, and backups age out within 30 days. Your mail stays with your provider, so Routira can sync it again if needed. During the alpha, we don't promise any particular availability.

Deleting data#

When you disconnect a mailbox, its password is deleted immediately and its synced copies within 24 hours; your mail at the provider isn't touched. We delete your account on request. Deleted data ages out of backups within 30 days. Details are in the privacy policy.

Incidents#

If a personal data breach occurs, we notify the data protection authority responsible for us (LDI NRW) within 72 hours where the law requires it, and inform affected people without undue delay if there's a high risk to them. Business customers hear from us within 48 hours, as set out in the data processing agreement.

What we don't have yet#

• No SOC 2 or ISO 27001 certification.
• No independent penetration test yet. We plan one before the public launch.
• No hardware security module for our master key.
• No bug bounty.

We'll update this list as things change.

Report a vulnerability#

If you've found a security issue in Routira, please tell us. We'll work with you to fix it, and we won't pursue good-faith research.

How to report. Email security@routira.com, in English or German. Include what you found, where (URL or app version), the steps to reproduce it, its impact, and how we can reach you. Mail to security@routira.com passes through Letterpier, which processes it in Germany and retains it for 30 days by default. Please don't include other people's personal data. If you need to share sensitive details, ask us for another channel first.

In scope: routira.com, app.routira.com and its API, and the Routira apps for Mac, iPad and iPhone.

Out of scope: services of third parties we use (please report to them directly), social engineering, physical attacks, denial of service and load tests, spam, reports from automated scanners without a demonstrated impact, and missing security headers without a demonstrated impact.

Rules for testing:

• Use only your own accounts and test data. Never access, change or delete other people's data. If you come across someone else's data, stop and tell us.
• No denial of service, no high-volume automated scanning, no phishing.
• Keep the details confidential until we've fixed the issue. We suggest 90 days, or sooner once it's fixed, as agreed with you.

What we promise:

• A first reply within three working days, and updates until the issue is resolved.
• Credit on this page once the issue is fixed, if you want it.
• If you follow these rules and act in good faith, we won't take legal action against you or report you to the authorities.

We don't pay rewards (no bug bounty). Our contact details are also available in machine-readable form at /.well-known/security.txt.

Acknowledgments#

No reports yet. With their consent, we'll thank the people who help us here.

Changes to this page#

• 27 September 2026: first version.