Security

You're trusting us with your inbox. Here's how we look after it.

This page describes what Tikkaroo does today, in plain words. No badges we haven't earned and no promises about features we haven't built.

What's in place

The controls that exist today.

Mailbox tokens are encrypted

When you connect Gmail or Outlook, the access and refresh tokens are encrypted with AES-GCM before they're written to the database. The key is held as a Cloudflare secret, separate from the data.

Each workspace is kept apart

Every ticket, customer, mailbox and API key belongs to one workspace, and every query is scoped to the workspace of the person or key making it. Realtime updates use a separate channel per workspace.

Hosted on Cloudflare

Tikkaroo runs on Cloudflare Workers, with data in Cloudflare D1 and realtime on Durable Objects. Traffic is served over HTTPS.

Passwords are hashed

Passwords are salted and hashed with PBKDF2-SHA256. We can't read them, and neither can anyone else.

Sessions and API keys are stored as hashes

Sign-in sessions use an HttpOnly cookie, and only a SHA-256 hash of the session token is stored. API keys for AI agents are shown once, stored as a hash, and can be revoked any time.

Only the mail access we need

We ask Google for gmail.modify and Microsoft for Mail.ReadWrite and Mail.Send: enough to read your support mail and reply in the same thread. You can disconnect a mailbox whenever you like.

Payments go through Stripe

Card details are entered on Stripe's checkout page and never touch our servers.

AI replies are labelled

When an AI agent replies or leaves a note through MCP, it's marked as coming from that agent, so your team can always see who said what.

Being straight with you

What we don't have yet.

No SOC 2 or ISO 27001 report

We're a young company and haven't been through a formal audit. If your security review needs one, we'd rather tell you now than surprise you later.

No single sign-on yet

Sign-in is email and password today. SSO is planned for the Big Red plan.

Questionnaires welcome

If you need a security questionnaire filled in, email us and we'll answer it honestly, including the parts where the answer is “not yet”.

Report a problem

Found a vulnerability?

Please email hello@tikkaroo.com with “Security report” in the subject. Include what you found and how to reproduce it.

Please give us a reasonable chance to fix it before you share it publicly, and don't access or change other people's data while testing. We'll reply, keep you updated and thank you properly.

Questions before you connect?

Ask us anything about how your data is handled. A real person will answer.