Security & Trust
Public information about SMailOS security, privacy, connected accounts, payments and operating trust.
Encrypted credentials
Gmail OAuth tokens are stored encrypted. OpenAI BYOK keys used by supported SMailOS AI functions are stored encrypted and separately for each workspace.
HTTPS
Public SMailOS pages and application traffic are served through HTTPS.
Google and connected-account data
Google and Gmail data is accessed only after the user authorizes the connection and within the permissions granted through OAuth.
The SMailOS Privacy Policy documents the applicable Google API Services User Data Policy and Limited Use requirements and the published handling rules for Google user data.
Stripe payments
Paid SMailOS checkout uses Stripe. Applicable payment and commercial conditions are described in the published SMailOS Terms and Privacy Policy.
SMailOS operator
SMailOS is operated by IRSE, računalniška infrastruktura in obdelava podatkov, Rajmond Hočevar s.p. , Slovenia.
SMailOS does not present itself as a US legal entity.
Certifications and requirements
SMailOS does not claim a certification, independent security report, data-residency commitment or contractual service level unless it is actually published or agreed in writing.
If your procurement process requires SOC 2, ISO 27001, a DPA, specific data residency, penetration-test evidence or a contractual SLA, contact SMailOS before purchase so the requirement can be discussed explicitly.
Security and support contact
For a security concern, email info@smailos.com and include SECURITY in the subject.
Do not include passwords, API keys or access tokens in the message.
This public page does not claim a fixed response-time SLA. Any specific contractual commitment is governed by the applicable written agreement.
Scope of this page
This page summarizes public SMailOS trust information. The Privacy Policy, Terms of Service and any signed agreement remain authoritative for legal, contractual and data-processing obligations.