Security at Reach

Reach sends email in your name, so we treat your mailbox and your contacts with real care. Here is how.

Your mailbox

• Reach never sees your Gmail password. Sending goes through a scoped access grant you can end at any time.
• Reach only sees the threads it started, never the rest of your inbox.
• Nothing is sent until you approve it.

Your data

• Encrypted in transit (TLS) and at rest. Access grants and calendar tokens get a second layer of AES-256-GCM encryption.
• Every workspace is isolated by row-level security in the database, so one customer's query cannot read another's rows.
• Encrypted daily backups, kept 35 days, with a copy in a second region.
• Deleting a workspace, a person or your account takes effect at once, and you can download your data at any time.

Your account

• Sign in with a one-time code sent to your email, or with Google. No passwords to leak.
• Risky actions, such as deleting data or forgetting a person, ask you to confirm it is really you.

Our infrastructure

• Runs on AWS in private networks, behind Cloudflare. Production secrets live in a managed secret store, never in code.
• Service logs are kept for a year for investigations, and we avoid writing personal data into them.
• Our full list of subprocessors is in the Privacy Policy.

Found something?

We would love to hear from you. Email security@reachcrew.app with the details and we will get back to you quickly. Please give us a fair chance to fix it before sharing it publicly.