Your mailbox keys, kept locked.
Hailyo needs your mailbox to send the emails you approve and read the replies. Here's exactly what it can do there, how the keys are stored, where your data lives, and how to report a problem.
What Hailyo can do in your mailbox.
Two things: send the emails you approved, and read the replies to them. Cold email goes out only from mailboxes you connect yourself.
Hailyo can
- Send the emails you approved
- Read replies to those emails
- Spot bounces and out-of-office replies
Hailyo won't
- Send anything you didn't approve (unless you switch approval off for a step)
- Use your mailbox to warm up anyone else's
- Microsoft 365
- Microsoft's own sign-in. Hailyo never sees your password.
- Google Workspace
- An app password you create for Hailyo, not your account password.
- Any other mailbox
- SMTP and IMAP login details.
To revoke access: disconnect the mailbox in Settings, remove Hailyo from your Microsoft account, or delete the Google app password.
Every mailbox key, encrypted at rest.
Microsoft sign-in tokens, Google app passwords and SMTP/IMAP logins are encrypted with AES-256-GCM before they reach the database.
Each workspace gets its own encryption key, derived with HKDF-SHA256, so the key for one workspace can't open another workspace's secrets.
- secret
- mailbox credential
- mailbox
- [email protected]
- cipher
- AES-256-GCM
- key
- HKDF-SHA256 · this workspace only
- stored as
- v1.9fQk…2a.Hc7L…pQ=
Your data stays in the US or EU.
Each workspace picks US or EU residency. EU workspaces are kept in a separate EU database and EU file storage.
US workspace
US database and file storage
EU workspace
Separate EU database and EU file storage
- Hailyo runs on a global cloud network.
- Daily backups, with point-in-time recovery for 30 days.
- Account data is deleted within 30 days of a verified account deletion.
- We don't sell data. The services we use are on the sub-processors page.
Who at Hailyo can see your account.
Hailyo's own admin tools are locked behind roles and a second sign-in step, and they leave a record.
Two-factor sign-in on every admin account.
An admin account without a one-time code from an authenticator app can't open the admin tools.
Roles limit what each admin can do.
Read-only, support and owner roles each see and change only what their job needs.
Every action on a customer account is logged.
The audit log can be added to, never edited or deleted.
Found a flaw? Tell us first.
Email [email protected]. It reaches the founder directly.
Machine-readable: /.well-known/security.txt
Please include
- What you found and where (URL or endpoint)
- Steps to reproduce it
- What an attacker could do with it
- How to reach you for follow-up
Please don't
- Open, change or delete other customers' data
- Send email to real people to test sending
- Slow down or overload the service
- Publish before we've had a fair chance to fix it
Questions about your data rather than a vulnerability go to [email protected].