Security & Access Control

Access to customer data is controlled at the application layer, not left to ambient trust. Every request runs through session-based authentication (Microsoft Entra ID sign-in); within an organisation, access is role-based — only designated admins can manage billing or members. AIERT's own internal staff tools are deliberately need-to-know: staff can see an organisation's plan, seat usage, and aggregate totals, and the contact details of its designated admins — never a full employee roster or individual usage.

• ✓All application secrets (payment processor keys, identity provider credentials, database credentials, internal service tokens) are stored as encrypted environment variables in our hosting platform (Vercel) — never committed to source control, never stored in plaintext files.
• ✓Access to these secrets is limited to authorised engineering personnel with access to the hosting account.
• ✓Secrets are rotated immediately if compromise is ever suspected, and reviewed periodically as part of ordinary engineering hygiene.
• ✓Database credentials are scoped to a dedicated managed PostgreSQL provider (Neon), connected over TLS, with credentials held only as environment variables — not embedded in application code.
• ✓Data at rest in that database is encrypted by the provider (AES-256), independently of anything MailBroom's own application code does — Neon is SOC 2 Type II compliant and manages encryption keys via AWS KMS/Azure Key Vault with restricted, logged access.

• ✓The database (Neon, managed PostgreSQL) is automatically backed up by the provider, with point-in-time recovery available to restore to a specific moment before an incident.
• ✓Application code is version-controlled in Git — every deployed version is independently recoverable by commit, with no separate code backup required.
• ✓Email content itself is never stored by MailBroom in the first place (see the Privacy Policy), so it isn't part of what's backed up here — the backup covers account, organisation, and usage data, not mailbox content.

If a secret is ever suspected to be exposed — through a leaked log, a compromised device, or any other route — it is rotated immediately and the affected credential is invalidated at the source (Stripe, Microsoft Entra ID, or the database provider, as applicable). This isn't a scheduled quarterly process; it's an immediate response triggered by suspicion, not calendar dates.

For security or access-control questions relating to MailBroom for Business, contact AIERT Ltd directly.

Email AIERT Ltd at support@aiert.co.uk