Encrypted at rest
Application-layer AES-256-GCM on OAuth tokens, message bodies and previews, attachments, contact photos and extracted memories, with keys that never live in the database holding them. AES-256 at the disk layer underneath.
- Home
- Security
Security
Boring, checkable promises.
Soda Road handles the most personal data most people have. The controls are written down here, the disclosure policy is public, and a machine-readable contact lives at /.well-known/security.txt.
A locked scope set
Identity, gmail.modify, gmail.send, and contacts.readonly asked only when you click Import. Published, justified, and changing it restarts Google's restricted-scope verification and a CASA assessment.
Row-level security
Policies on every user-data table as a forensic backstop behind the application's own checks.
Append-only audit log
Consent grants, exports, deletions, agent actions and sends are recorded and cannot be edited.
Agents are fenced
Seven permissions intersected with channel scope at one enforcement point; recipient allowlists, rate caps, a loop breaker and a per-channel kill switch on every automated send.
Leaving is immediate
Self-serve export with everything decrypted, and deletion that removes all linked data in one transaction with no soft-delete period.
Responsible disclosure
Report a vulnerability.
Email security@sodaroad.com with a description of the issue, the steps to reproduce, and the impact you observed. Soda Road processes Gmail content under Google's restricted-scope policy, so we treat security reports as a first-class input.
Disclosure policy
We follow coordinated disclosure. Please report privately first, give us a reasonable window to remediate, and refrain from public disclosure until a fix has shipped. Our default coordination window is 90 days from initial report; we will negotiate a shorter or longer window in good faith based on severity and complexity. Public credit will be offered if you would like it. Good-faith research conducted under this policy is welcome and is not a violation of our Terms of Service.
In scope
- The Soda Road web application at
sodaroad.comand any direct subdomains we operate. - The Google OAuth flow, consent screen, and token-handling endpoints.
- The Gmail sync engine and the classification pipeline that sorts mail into channels.
- The inbound and outbound mail bridge for chats with email participants, including the
in.sodaroad.comwebhook. - The agent runner and its per-agent permission and budget gates.
- Phone verification and the password-reset channel (
/forgot). - The self-serve account export and account deletion endpoints (
/api/account/export,/api/account/delete). - The audit-log subsystem.
- Authentication, session, IDOR, authorization, and Row-Level-Security bypass classes.
- Secret leakage, including in logs, error messages, exports, or static assets.
Out of scope
- Social engineering, phishing of Soda Road staff, or physical attacks against any person or facility.
- Denial-of-service, volumetric load testing, or rate-limit stress tests.
- Vulnerabilities in third-party services Soda Road depends on (Google, Supabase, Vercel, Resend, Twilio, OpenRouter, and the model providers reached through it). Please report those directly to the vendor.
- Automated scanner output without a working proof-of-concept demonstrating impact.
- Missing best-practice headers, missing rate limits on unauthenticated endpoints, or missing CSP directives without an exploit chain.
- Clickjacking on pages without sensitive state-changing actions.
- Self-XSS, or attacks requiring an already-compromised browser, device, or Google account.
Response timeline
- Acknowledgment: within 3 business days.
- Triage decision: within 7 business days. We will tell you whether we accept, dispute, or need more information.
- Remediation target: Critical severity within 7 days; High within 30 days; Medium within 60 days; Low on a best-effort schedule.
No bug bounty
Soda Road does not currently operate a paid bug bounty program. We deeply appreciate good-faith reports and will publicly credit researchers on request, but we cannot offer monetary rewards at this time.
Retention
TLS 1.2+ in transit. No fixed retention clock on stored mail: it is kept until you delete it or delete your account. The full retention and storage details live in our Privacy Policy; the how-to is on Managing and deleting your data.
Last updated: September 2026 · Accounts onboarded: 0 / 120
Take your address.
Free to talk. Your address is the account, and there is nothing to install.