RadMail · Trust
Trust & compliance
How we handle your data, who processes it, and how the platform serves regulated tenants. Everything below is a statement of what is actually in force — we don’t claim certifications we don’t hold.
The proof, not the promise
Every refusal ships a receipt you can check yourself
When RadMail hard-stops an unsafe send — a wire change, a money request, a first-contact sender — it issues a signed, tamper-evident receipt. Anyone you hand it to — a bank confirming a payment instruction, an auditor sampling controls, a customer checking your story — can verify it with no login and no access to anyone’s mailbox. The page only checks the signature; alter a single character and verification fails.
The receipt carries only the decision id, the reason class, and a timestamp — never email content. We haven’t seen another inbox AI ship a machine-checkable refusal contract: most can tell you they blocked something, but they can’t hand you proof a third party can independently confirm.
Security posture
Postgres Row-Level Security on every tenant-scoped table; a row can never be read cross-tenant even if an app query forgets its filter.
TLS in transit; encryption at rest. Regulated tenants run on a dedicated database plane. A customer-managed encryption key is required for this regime and is not yet in place. Data is encrypted at rest with the database platform's own key. This is a known, tracked gap — not a silent one. (Compliance register: dedicated DB (verified) + Neon platform encryption at rest; CMK is REQUIRED and NOT YET IN PLACE.)
Role-based access (owner / manager / member / viewer). API access uses scoped, revocable, per-org keys — hashed at rest.
Append-only audit trail (database-enforced — no updates or deletes). Regulated tenants additionally log reads.
Email content is fenced as untrusted input to the model. Regulated tenants are routed to a BAA-covered model endpoint only.
We are building toward a SOC 2 Type II report; the controls are in place and the observation clock is the next milestone. We share our current status under NDA.
Subprocessors
The third parties that may process tenant data, their role, and the agreement under which they do so. This is our vendor register.
| Subprocessor | Role | Purpose | Region | Agreement |
|---|---|---|---|---|
| Anthropic (Claude API, direct) | Language model | Email classification + reply drafting (non-regulated tenants). | US | — |
| AWS Bedrock (Claude on Bedrock) | Language model | LLM for regulated tenants (BAA-covered path). | US commercial (us-west-2 primary; us.* cross-region profiles) | BAA signedFedRAMP moderate |
| AWS Bedrock (GovCloud) | Language model | LLM for federal/CUI tenants (FedRAMP-authorized). | us-gov | —FedRAMP high |
| Neon (Postgres, shared) | Database | Tenant data store for the shared-RLS pool (non-regulated). | US | — |
| Neon (dedicated, BAA) | Database | Dedicated per-tenant DB for regulated tenants. | US | BAA signed |
| Resend (ESP) | Email delivery | Outbound email delivery (non-regulated tenants). | US | — |
| Resend Inbound (forwarding relay) | Email relay | Inbound forwarding-address relay (fast onboarding, non-regulated). | US | — |
| Microsoft 365 (BAA mailbox) | Mail provider | BAA-covered mailbox connection + send path for regulated tenants. | US | BAA signed |
| AWS SES (email send) | Email delivery | Outbound email delivery for regulated tenants (BAA-eligible path). | US | BAA signedFedRAMP moderate |
| Twilio (SMS alert fanout) | Email relay | SMS 'Right Now' alerts (non-regulated tenants only). | US | — |
| Tenant-configured webhook endpoint | Email relay | Right-Now event fanout to a URL the TENANT supplies. | tenant-defined | — |
| Browser push services (Apple/Google/Mozilla) | Email relay | Web-push 'Right Now' alerts. | vendor-defined | — |
| Vercel (host) | Hosting | Application hosting + edge. | US | covered by terms |
Regulated tenants — computed subprocessor coverage
Compliance is a per-tenant attribute, not a one-size posture. For a regulated tenant, the platform filters the subprocessor set to the covered subset and refuses to route data to anything outside it. A tenant’s chain validity is computed from that coverage, not assumed. For HIPAA tenants we sign a BAA; for federal tenants we operate on FedRAMP-aligned infrastructure under a shared-responsibility model.
BAA-covered subset only
FedRAMP-authorized subset only
- ⚠ AWS Bedrock (GovCloud): FedRAMP authorization claimed "high" but UNVERIFIED — no verifiedOn/evidenceUri
- ⚠ Vercel (host): not FedRAMP-authorized
How we talk about compliance
Using RadMail does not by itself make your organization compliant with any regulation — compliance is a shared responsibility between your organization and us. We provide BAA-covered infrastructure and the controls; you operate within your own program. We sign a BAA for HIPAA tenants and operate on FedRAMP-aligned, 800-171-ready infrastructure for federal tenants. We never claim to be “certified” for a frame we have not been assessed against.
RadMail v0.80.0 · Home · Get started