Security at Reachkit

Last Updated: September 16, 2026

Reachkit connects to your email accounts and holds your prospect lists, campaign content and replies. That is a lot of trust, and this page explains how we protect it. It is written for the people who review vendors before signing, so it stays concrete and avoids marketing language. If you have a question this page does not answer, email security@reachkit.ai.

Summary

All data is hosted in the United States with a major cloud infrastructure provider, on firewalled servers that receive security updates automatically.
Inbox passwords, OAuth tokens, CRM credentials and API keys are encrypted at rest with AES-256-GCM. The encryption key is stored separately from the database.
Google Workspace and Microsoft 365 inboxes connect through OAuth, so Reachkit never sees or stores your mailbox password.
Connections to your email provider on the standard mail ports use TLS with certificate verification.
Account passwords are hashed with bcrypt and are never stored in a recoverable form.
The database is backed up every day, with continuous transaction-log archiving, to encrypted off-site storage with a separate provider.
Your campaign data, lead lists and replies are used to provide the service to you and, only in de-identified and aggregated form, to improve it. We do not sell them.
Reachkit does not currently hold a SOC 2 or ISO 27001 certification. We answer security questionnaires and provide further detail on request.

Infrastructure

Reachkit runs on dedicated servers in United States data centers operated by a major cloud infrastructure provider. The application, the database and the monitoring stack run on separate servers that talk to each other over a private network.

A cloud-level firewall and a host-level firewall on every server expose only HTTPS and key-based administrative SSH to the internet. The database accepts connections solely from the application server over the private network and is not reachable from the public internet.
Administrative access is over SSH with public-key authentication only. Password login and root login are disabled, and access is limited to Reachkit’s engineering team.
Operating system security updates are installed automatically.
Releases are built as immutable container images in a continuous-integration pipeline and pulled by the production server with a read-only registry credential. The build pipeline has no access to production, and the application runs as an unprivileged user inside its container.
New releases are deployed blue/green: the new version must pass health checks before it receives any traffic, and the previous version keeps serving if it does not.

Encryption

In transit. All traffic to reachkit.ai is served over HTTPS with automatically issued and renewed certificates, and plain HTTP requests are redirected to HTTPS. Traffic between our own servers stays on a private network that is not routable from the internet.

To your email provider. Connections to your mail server over IMAP and SMTP use TLS with certificate and hostname verification: implicit TLS on ports 465 and 993, and a STARTTLS upgrade on port 587.

At rest. Credentials that would grant access to your systems are encrypted at the application layer before they are written to the database, using AES-256-GCM with a unique nonce per value. This covers inbox passwords, OAuth access and refresh tokens, CRM integration credentials and Reachkit API keys. The encryption key is held in the application’s runtime configuration, separate from the database, and is never stored in the database or committed to source control in plaintext. Backups are encrypted at rest by the storage provider.

Passwords and one-time codes. Reachkit account passwords are hashed with bcrypt and must be at least 12 characters. Email verification codes are stored only as SHA-256 hashes, expire within minutes and are limited in how many times they can be tried. Password reset links are single-use and expire within 30 minutes.

Email account access

Cold email tools need real access to your inboxes, so this is the part we are most careful about.

OAuth for Google Workspace and Microsoft 365. You authorize Reachkit through your provider’s consent screen. We receive a token scoped to sending and reading mail plus your basic profile, and we never see or store your mailbox password. You can revoke that authorization at any time from your Google or Microsoft account settings.
Tokens are encrypted. Access tokens are refreshed automatically, and every refreshed token is re-encrypted before it is stored.
Deleting an inbox deletes its credentials. When you remove an inbox from Reachkit, the stored tokens or passwords are deleted with it.
Google API Services User Data Policy. Reachkit’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Application security

Every browser request is protected against cross-site request forgery, and all database access is parameterized.
HTML in replies you receive is sanitized against an allowlist before it is rendered in the Unibox, so a malicious sender cannot run code in your browser.
Inbound webhooks from our payment and integration partners are signature-verified before they are processed.
Signup is protected against automated abuse, and the public API, the MCP server and account verification codes are rate-limited.
Sessions are server-side tokens. Signing out invalidates them, and resetting your password signs out every session.
Uploads are size-limited, and temporary import files are deleted as soon as the import finishes.

Access control

Every campaign, inbox, lead, conversation and API key belongs to exactly one workspace, and every request is checked against the workspace of the signed-in user.
Team members are invited with per-feature permissions (inboxes, campaigns, Unibox, CRM, settings) that are enforced on the server, not just hidden in the interface.
API keys are bound to a single workspace and are rate-limited.
Reachkit staff access a customer account only to resolve a support request from that customer or to investigate abuse of the platform.

Backups and availability

The production database is backed up in full every day, and transaction logs are archived continuously, which allows point-in-time recovery.
Backups are stored off-site with a separate storage provider, encrypted at rest, and retained on a rolling schedule.
An independent monitoring service alerts us if a backup or a log archive stops arriving.
Infrastructure, application and database health are monitored continuously, with automated alerts for availability, error rates, database load and job backlogs.

Data handling and retention

What we store. Your account details, connected inbox credentials, campaign content, lead lists, and the replies your campaigns receive. You retain ownership of all of it.
How we use it. To provide the service to you and, in de-identified and aggregated form, to improve it, as set out in our Terms of Service. We do not sell your campaign data, lead lists or replies. Some features (copy generation, reply classification, the support assistant) send the specific content that feature needs to an AI model provider, and nothing more.
Where it lives. In the United States. Our Privacy Policy covers international transfers.
Deletion. You can delete inboxes, campaigns, leads and conversations yourself at any time. To delete a workspace or your entire account, contact support@reachkit.ai and we will remove the data within 30 days.
Suppression. We maintain a suppression list so that do-not-contact and erasure requests from recipients are honored across the platform.
Payments. Card details are entered directly with our PCI-DSS compliant payment processor and never touch Reachkit’s servers.

Sub-processors

Reachkit uses a small number of service providers to run the platform. Each one is contractually limited to using the data only to provide its service to us. By category:

Cloud infrastructure and backup storage (United States)
Payment processing
Transactional email delivery (verification codes, invitations, notifications)
Email verification and anti-fraud screening
B2B contact data for the Lead Finder
Domain registration and mailbox provisioning partners, when you buy domains or inboxes through us
AI model providers
Product analytics and infrastructure monitoring

A full list with locations is available to customers on request. We notify customers before adding a sub-processor that will process their data.

Separately, integrations you enable yourself (HubSpot, Zoho, Odoo, Slack, webhook consumers such as Zapier and n8n, and MCP clients such as Claude or ChatGPT) receive data only at your direction and only while you keep them connected.

Compliance

GDPR. For the contact data you upload and the replies you receive, you are the controller and Reachkit is the processor. Our data processing terms are in Section 10 of the Terms of Service. Transfers out of the EU rely on Standard Contractual Clauses.
CCPA. Reachkit acts as a service provider for California consumers.
Incident notification. If we confirm a breach affecting your data, we will notify you without undue delay and no later than 72 hours after confirmation.
Certifications. Reachkit does not currently hold a SOC 2 or ISO 27001 certification. We are happy to complete your security questionnaire and to share additional detail about our controls under NDA. Email security@reachkit.ai.

Reporting a vulnerability

If you believe you have found a security issue in Reachkit, email security@reachkit.ai with enough detail for us to reproduce it. We acknowledge reports within two business days and keep you informed while we fix the issue.

Please act in good faith: do not access, modify or delete data that is not yours, do not run automated scanners against our infrastructure, do not degrade the service for other users, and give us reasonable time to address the issue before disclosing it publicly. We do not run a paid bug bounty program, but we credit reporters who wish to be named.

Questions

Security questions, questionnaires and requests for further documentation: security@reachkit.ai. Privacy requests: privacy@reachkit.ai.