> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gork.email/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Overview

> Architecture, encryption, isolation, and compliance posture.

How Gork protects your mail, credentials, and tenant boundary.

## Architecture

* **Outbound** sends through Amazon SES from the `ap-southeast-2` region, with per-organization DKIM signing.
* **Inbound** lands on Gork's SES receipt rule (S3 + SNS), is parsed and sanitized, then queued for delivery — raw MIME is archived to Cloudflare R2, heavy HTML bodies offloaded from the database.
* **Control plane**: Cloudflare Workers API, Neon Postgres, Cloudflare Queues for parsing and webhook fan-out. Every queue consumer is idempotent with exponential-backoff retries.

## Data protection

* **TLS everywhere**: HTTPS for API and dashboard, TLS for SES hops.
* **API keys are never stored raw** — only SHA-256 hashes. The raw key is shown once at creation.
* **Webhook secrets** (`whsec_...`) are shown once at creation/rotation and never returned by list endpoints.
* **Inbound payloads are zero-trust**: `<script>`, `<iframe>`, inline event handlers, and `javascript:` URLs are stripped before storage or forwarding; attachment downloads are content-typed with `nosniff` guards.
* **Your mail is not training data** — see the [privacy policy](https://gork.email/privacy).

## Tenant isolation

Every query is scoped to your organization at the application layer (`organizationId` on every row); API keys, inboxes, and webhooks cannot cross the boundary, and inbox-scoped keys are further restricted to a single address with mail-only permissions.

## Your responsibilities

* Store API keys and webhook secrets in a secrets manager, never in client-side code or repos. Rotate on any suspected leak.
* **Verify webhook signatures** before acting on deliveries — see [Verify webhook requests](/webhooks/verify-requests).
* Use **inbox-scoped keys** for agents so one leaked credential cannot touch the rest of the fleet.
* Set a **spend protection cap** so a runaway agent cannot generate unbounded overage — see [Billing](/account/billing).

## Compliance & subprocessors

Subprocessors: **AWS** (SES email delivery), **Neon** (Postgres), **Cloudflare** (Workers, R2, Queues), **Dodo Payments** (billing). Data resides in the providers' managed regions (SES sending in `ap-southeast-2`).

Formal certifications (SOC 2, ISO 27001) are on the roadmap — not yet held. If your procurement needs a DPA, security questionnaire, or roadmap commitments, contact support and we will work through it with you directly.