Skip to main content
How Gork protects your mail, credentials, and tenant boundary.

​
Architecture

  • Outbound sends through Amazon SES from the ap-southeast-2 region, with per-organization DKIM signing.
  • Inbound lands on Gork’s SES receipt rule (S3 + SNS), is parsed and sanitized, then queued for delivery — raw MIME is archived to Cloudflare R2, heavy HTML bodies offloaded from the database.
  • Control plane: Cloudflare Workers API, Neon Postgres, Cloudflare Queues for parsing and webhook fan-out. Every queue consumer is idempotent with exponential-backoff retries.

​
Data protection

  • TLS everywhere: HTTPS for API and dashboard, TLS for SES hops.
  • API keys are never stored raw — only SHA-256 hashes. The raw key is shown once at creation.
  • Webhook secrets (whsec_...) are shown once at creation/rotation and never returned by list endpoints.
  • Inbound payloads are zero-trust: <script>, <iframe>, inline event handlers, and javascript: URLs are stripped before storage or forwarding; attachment downloads are content-typed with nosniff guards.
  • Your mail is not training data — see the privacy policy.

​
Tenant isolation

Every query is scoped to your organization at the application layer (organizationId on every row); API keys, inboxes, and webhooks cannot cross the boundary, and inbox-scoped keys are further restricted to a single address with mail-only permissions.

​
Your responsibilities

  • Store API keys and webhook secrets in a secrets manager, never in client-side code or repos. Rotate on any suspected leak.
  • Verify webhook signatures before acting on deliveries — see Verify webhook requests.
  • Use inbox-scoped keys for agents so one leaked credential cannot touch the rest of the fleet.
  • Set a spend protection cap so a runaway agent cannot generate unbounded overage — see Billing.

​
Compliance & subprocessors

Subprocessors: AWS (SES email delivery), Neon (Postgres), Cloudflare (Workers, R2, Queues), Dodo Payments (billing). Data resides in the providers’ managed regions (SES sending in ap-southeast-2). Formal certifications (SOC 2, ISO 27001) are on the roadmap — not yet held. If your procurement needs a DPA, security questionnaire, or roadmap commitments, contact support and we will work through it with you directly.