Security overview

This page explains, in plain terms, how Fifi keeps your workspace's data safe. It's written for customers and for anyone answering a security questionnaire. The full legal terms are in the Privacy Policy (/privacy) and Terms of Service (/terms).

Your data stays in your workspace

• Every record belongs to one workspace. Fifi checks this twice: in the app, which adds your workspace to every database query, and in the database itself, whose row-level security refuses rows from any other workspace even if the app made a mistake.
• The app connects to the database as a restricted user that can't switch those rules off.
• Automated tests try to read and change another workspace's records for every feature, on every change. They must fail.
• API keys, webhooks, background jobs and public pages (booking, forms) all work inside one workspace the same way.

Signing in

• No passwords. You sign in with Google, Apple or a one-time email code.
• Codes are 6 digits, last 10 minutes, work once, allow 5 tries, and are stored only as a hash.
• Sign-in attempts are rate-limited, and code requests are protected by Cloudflare Turnstile.
• Apple's "Hide My Email" relay addresses are refused.
• Only verified email addresses are accepted, and sign-in methods are linked only by verified email.
• Sessions live in the database, so they can be revoked. They end after 12 hours idle or 30 days at most. Cookies are httpOnly, Secure and SameSite=Lax.
• You get an email when you sign in from a new device, and can sign out of any session in Settings → Sessions.

Who can see and change what

• Three roles (owner, admin, member), checked on the server by one permission layer. See Roles and permissions.
• Deactivating someone removes their access immediately.
• Deleted records are hidden everywhere until restored or purged.
• CorporateMutt staff can see each workspace's name, owner email, member count, creation date, status, plan and AI usage totals, to run the service. They can't see your contacts, deals, email or other records in the operator or support consoles. Every operator action is logged, and support staff opening your tickets or your workspace's diagnostics is recorded in your activity log. A small number of engineers have access to the production systems, which can reach any data; they use it only for support you ask for, security or legal obligations, and a sign-in as a user is recorded with its reason.
• Support tickets (v0.62.0) can be read by the person who opened them and by your workspace's owners and admins, and by Fifi's support staff; other members can't. Staff-only notes are unreadable to the app itself. Ticket text is never in the activity log, Reports, Ask Fifi, the API or webhooks, and never in Fifi's logs. Screenshots are checked, stripped of hidden details, served sandboxed and uncached, and never sent to an AI. We email only the ticket's owner, at their verified address. Tickets are kept 180 days after they close (2 years for the bare record) and are removed with your account or workspace. See Getting support.

Email

• Connecting Gmail asks only for gmail.readonly and gmail.send. Fifi never changes or deletes your mail.
• Fifi keeps only conversations with your workspace's contacts and companies, never mail among teammates, and never mail with contacts marked Don't track email. See Connecting your email.
• Mailbox and QuickBooks access tokens, webhook secrets and texting registration details are encrypted (AES-256-GCM) with a key held only in Fifi's hosting secrets.
• Fifi keeps each email's plain text and a cleaned copy of its formatting (HTML), with anything that could run or track removed, and shows formatted emails in a sandboxed frame, so email content can't run code, fill in forms or reach the rest of Fifi. Pictures from the internet stay hidden until you click Show images on that message (see Sending email and tracking).
• Email bodies are never written to logs.
• Disconnecting gives Fifi's Google access back. You can delete everything synced from your mailbox at any time.
• Open tracking is disclosed and can be turned off per workspace.

Third parties

This is a summary. The list that counts is in the Privacy Policy (/privacy#sharing).

The support assistant. The chat in Get support is answered by Claude (Anthropic) from Fifi's own help articles. It receives only what the member types into that chat, with email addresses, phone numbers, card numbers, passwords and keys removed first, a short list of technical facts (the kind of page, plan, business type, modules, role, browser type, recent error references), and the help articles. It never receives a name, an email, your workspace's name, any record, email, text, note, file or screenshot, or anything from another workspace; Fifi's own tests check the exact requests. It has no tools or database access, its answers are checked before they're shown, billing, security, lost-data and privacy requests that we recognise are handed to a person without being sent to it, and a chat counts as answered only when the member clicks "That solved it". Owners and admins can turn it off (Settings → Workspace). Anthropic doesn't use this to train its models. See Getting support.

Fifi never sells personal information.

The web app

• A strict Content Security Policy with per-request nonces, HSTS, and pages that can't be framed by other sites (except forms, which are designed to be embedded).
• Server-side validation of every input.
• Protection against cross-site request forgery on every change.
• Rate limits on sign-in, invitations, search, exports, the API, webhooks and public pages.
• Requests bigger than 256 KB are refused before Fifi reads them (imports and uploads have their own larger limits).
• CSV exports escape cells that a spreadsheet would treat as formulas.
• Webhooks Fifi sends are signed (HMAC-SHA256), go only to public HTTPS addresses, and never include note text, email content or files.
• Inbound notices from Google are verified (signed tokens) before Fifi acts on them.

Records of what happened

• The activity log records creates, changes, deletes, role changes, invitations, imports, exports and settings changes. It never shows personal values, only that they changed. Owners and admins can read it; nobody can edit it.
• IP addresses in the activity log are cleared after 90 days. Expired sign-in records are deleted daily.

Deleting data

• Deleted records stay in Trash for 30 days, then are purged nightly.
• Deleting a workspace gives a 30-day grace period, then purges all its data.
• Deleting your account removes you, and schedules workspaces where you were the only member for deletion.
• Fifi takes an encrypted backup of the database every night and keeps one for each of the last 14 days, 8 weeks and 6 months, so deleted data can stay in a backup for up to about 6 months (and in the hosting provider's disk snapshots for 14 days). Backups are used only to restore Fifi, and a restore deletes again anything deleted since the backup.
• Issued invoices are kept at least 7 years and completed service records at least 3 years, even if their customer is deleted, until the workspace itself is deleted. See Your data, privacy and how long Fifi keeps records.

Supply chain

• Dependencies are pinned in a lockfile and checked by npm audit and Dependabot.
• The Docker base image is pinned to an exact version.
• All secrets are held in Fly's secret store, never in the code.

Known limits

• Google hasn't verified Fifi's Gmail access. Google shows an "unverified app" warning when you connect Gmail, and limits how many people can ever connect it, so connecting Gmail may not be open to everyone. Our security practices are described on this page and checked by our own internal self-assessment; that is not a certification.
• CorporateMutt holds no security certification (such as SOC 2 or ISO 27001). This page describes what Fifi does; it isn't an audit report.
• There's no single sign-on (SAML/OIDC), SCIM, or customer choice of data region yet. All data is hosted in the US.
• The Terms of Service and Privacy Policy haven't been reviewed by a lawyer yet.

Related guides

• Roles and permissions
• Activity log
• Your account, profile and sessions
• For engineers: Security model