Security

Our approach

You trust Twintual with your inbox, your chats and your calendar. This page explains, plainly, how we protect them. We only list what we actually do today, and we update this page when that changes.

1. Encryption

1.1 In transit

Every connection to Twintual, from the web app, the mobile apps and the providers we sync with, uses HTTPS (TLS). Unencrypted connections are redirected or refused.

1.2 Connection tokens

When you connect Gmail, Outlook, Slack or any other channel, the access tokens that let Twintual read and send on your behalf are stored encrypted in a dedicated secrets vault, separate from the rest of your data. You can disconnect a channel at any time, which removes its tokens.

2. Where your data lives

• Twintual runs on servers we operate in Hetzner data centres in the European Union.
• Servers are firewalled, accept only the traffic they need, and rate-limit abusive clients.
• Backups are encrypted, kept off-site, and restored regularly to prove they work.

3. Your data stays yours

3.1 Isolation between accounts

Each account can only reach its own data. This is enforced in the database itself, not just in the app, and an automated test tries to read across accounts on every build. A build that leaks data between accounts does not ship.

3.2 You decide what gets sent

Twintual drafts replies; you send them. Nothing goes out in your name unless you approve it, or you have explicitly turned on automatic sending for a contact or category, which you can switch off at any time.

3.3 Our team's access

• Our operator tools show account metadata (plan, connections, sync health), not the content of your messages.
• Operator access requires company single sign-on with multi-factor authentication.
• Access to production systems is limited to the people who run them.

4. How the AI handles your data

• To draft, summarise and prioritise, Twintual sends the relevant message text to an AI model provider: OpenAI, with Google Gemini as a backup when OpenAI is unavailable.
• We use these providers through their business APIs. Under those API terms, your data is not used to train their models.
• Your writing style and preferences are stored in your own account, not shared with other users.
• Message content is treated as data, never as instructions to the system, to resist prompt-injection attacks.

5. Building it securely

• Every change is reviewed and runs through automated tests before it reaches production.
• Every build is scanned for vulnerable dependencies, leaked secrets and insecure code.
• Security fixes are prioritised and shipped quickly.

6. Compliance

• Google user data: Twintual's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Google CASA: our Cloud Application Security Assessment (Tier 2) is in progress with an authorised assessor.
• GDPR: data is hosted in the EU, and you can ask us to access, export or delete your data at any time.

7. If something goes wrong

Our systems are monitored and alert the team automatically. If an incident affects your data, we will tell you promptly and explain what happened and what we are doing about it. Live service status is always at status.twintual.com.

8. Your part

• Use a strong, unique password, or sign in with your Google or Apple account.
• Keep your devices and apps up to date.
• Disconnect channels you no longer use.
• Tell us straight away if you notice anything unusual.

9. Reporting a vulnerability

Found a security issue? Email security@twintual.com with the details. We welcome responsible disclosure, will acknowledge your report and keep you updated while we fix it. Please give us a reasonable time to fix it before sharing it publicly.

10. Contact

Security: security@twintual.com
Help: help@twintual.com
Twintual Inc., 2810 N Church St #590226, Wilmington, DE 19802, United States