Security and data handling

LinqDesk holds mailbox credentials and client data, so this page sets out plainly how both are protected.

Credentials

Gmail refresh tokens and SMTP passwords are encrypted at rest using AES-256-GCM with a key held only in the server environment, never in the database. Disconnecting a mailbox deletes the stored credential immediately.

Mailbox access is scoped to your prospects

LinqDesk requests permission to send mail and to read mail. Reading is used for three things: detecting replies and bounces to outreach it sent, showing each prospect's conversation inside the app (including outreach you sent directly from Gmail), and listing recipients of your recent sent mail so you can assign them to a client. Only messages that match a prospect's address, thread or website domain are stored; everything else is discarded as soon as it is filtered. Stored mail is deleted with the prospect, never changes anything in your mailbox, and is never exposed to other workspaces or to third-party providers (AI drafting receives one reply and the client profile, not the mailbox).

Isolation between customers

Every record carries a workspace identifier, and every query is scoped to the authenticated workspace. Team member logins are scoped to their own workspace and cannot change workspace settings, billing or mailboxes, or bulk-delete data. Removing a member ends their access immediately.

Authentication

Passwords are hashed with bcrypt. Sessions use signed, HTTP-only cookies with a 30 day lifetime. Sign-in and sign-up endpoints are rate limited per IP address. The server refuses to start on a public URL without its own generated secrets.

Sending safeguards

Per-mailbox daily caps that count every email sent, a fixed sending window, weekday-only defaults, a List-Unsubscribe header on every email, automatic handling of bounces and opt-out replies (the address goes on a permanent do-not-contact list) all exist to keep sending volume low and reputable. Sequences stop the moment a human replies; out-of-office auto-replies do not count as a reply.

Outbound requests

When LinqDesk visits a prospect site or checks a won link, it only connects to public internet hosts; private and internal addresses are refused.

Payments

Subscriptions run through Dodo Payments. Card details never reach LinqDesk servers. Webhook events are verified with an HMAC signature and a timestamp window before any plan change is applied.

Reporting an issue

If you believe you have found a security problem, email security@linqdesk.com with the details. We will acknowledge within two business days.