Handing over a mailbox is a real decision. Here is what Trupeo does with it.
Who checked Trupeo's security, where your mail is kept, who can get in, and how to report a flaw. Plain answers, with dates where they matter.
30-day free trial, no credit card required. Keep your current email address.
Independent security assessment
- Program
- CASA, level AL1
- Assessor
- TAC Security
- Review completed
- 15 September 2026
- Google's confirmation
- Pending
- Renewal
- At least every 12 months
Independent assessment
Checked by an outside lab, not only by us.
Google treats reading and managing a Gmail inbox as a restricted permission. An app like Trupeo, which uses it from its own servers, has to go through a security assessment by an independent lab. The program is called CASA.
Trupeo's assessment, at level AL1 (formerly called Tier 2), is run by TAC Security, one of the labs authorized by the App Defense Alliance to carry out these assessments. TAC Security completed its review on 15 September 2026.
The last step is Google's confirmation. It had not arrived on 17 September 2026, and this page will be updated when it does.
It is not a one-off: Google asks for a new assessment at least every 12 months.
Your mailbox
Your mail stays where it is.
Trupeo connects to the address you already have: Gmail, Microsoft 365 or Outlook through Google's or Microsoft's own sign-in page, and any other provider over IMAP. Your mail stays with your provider, and Trupeo works from a copy of the messages it shows your team, stored at Microsoft Azure in Europe. If you stop using Trupeo, your mailbox does not move and nothing in it is deleted.
What Trupeo changes in your mailbox
Some of what your team does in Trupeo happens in your mailbox too: a conversation marked as done is archived and marked as read there, and what you move to the trash or mark as spam is moved there as well. For Gmail, Trupeo has no permission to delete mail permanently.
Access
Everyone signs in as themselves.
Each member of your team has their own Trupeo account, and a mailbox is shared only with the people its owners invite. Nobody has to pass the mailbox password around.
Two-step verification
If you sign in with a password, you can turn on two-step verification in Account settings, on the Security tab: a code from an authenticator app, with backup codes in case you lose your phone. It is available to every account with a password, and not required.
If you sign in with Google or Microsoft, Trupeo does not add a code of its own: two-step verification is handled by that account, so turn it on there.
When Trupeo support opens your account
Nobody at Trupeo reads your messages, except when you ask us to or where security or the law requires it. When a Trupeo administrator opens your account, it is recorded, and you can see every time it happened in Account settings, on the Security tab, in the Trupeo support access section. No notification is sent: that list is the place to check.
Each member sees only the times their own account was opened. When support opens another member's account, it reaches the same shared mailbox, so a mailbox owner who wants the full picture can ask the other members to check their list too.
Stored files
Since 10 July 2026, Trupeo encrypts the full text and attachments of your messages before storing them, with a key for each mailbox derived from a secret kept separately in Azure Key Vault. Copying one of those files out of storage is not enough to read it: the secret is needed as well.
Hosting
Hosted in Europe, encrypted in transit and in storage.
Trupeo runs on Microsoft Azure. The database and the application servers are in France (Azure France Central region). Stored message bodies and attachments are in the European Union (Azure West Europe region).
Encryption
The site and the app are served over HTTPS only, and Trupeo's connections to Gmail and Microsoft are encrypted too. Its connections to an IMAP or SMTP server are encrypted when that server offers it: Trupeo does not refuse a server that does not.
Azure encrypts the database and the file storage on its disks. On top of that, Trupeo encrypts two things itself before storing them (AES-256-GCM): the login details that let it reach your mailbox, and, for everything stored since 10 July 2026, the full text and attachments of your messages, with a key for each mailbox derived from a secret kept separately in Azure Key Vault. A message's subject, its addresses and a short preview, and what your team writes in Trupeo, such as replies, forwards and internal notes, are kept in the database under Azure's encryption only, without that extra layer.
Payments
Your payment details go to Stripe, not to us.
Subscriptions and payments are handled by Stripe. Card or bank details are typed into Stripe's own payment form and sent straight to Stripe: they never pass through Trupeo's servers. Trupeo only reads back a summary to show you in the billing settings, such as the card brand and its last four digits.
Third parties
The other services involved.
Here are the outside services Trupeo relies on, what each one does, and whether it can see your mail.
Microsoft Azure
Hosts Trupeo: application servers, database and file storage.
Sees your mail: Yes, it stores Trupeo's copy.
Google, Microsoft and IMAP providers
Where your mailbox already lives. Trupeo reads, sends and organizes mail there for your team.
Sees your mail: Yes, your mail is already there.
Stripe
Subscriptions and payments.
Sees your mail: No.
Azure Communication Services
Sends the emails that come from Trupeo itself, such as account confirmations and notifications by email.
Sees your mail: Partly: a notification email can quote a conversation's subject and the sender's name, not the text of the message.
Cloudflare Turnstile
Keeps bots away from the site's forms.
Sees your mail: No.
Google Analytics
Measures how the site and the app are used.
Sees your mail: No.
Microsoft Clarity
Records how pages are used, to see where people get stuck.
Sees your mail: No, the parts of the screen that show mail are masked.
Google Chat
Tells the Trupeo team when someone writes to support or uses the contact form.
Sees your mail: No, only what you write to us.
GitHub
Holds Trupeo's source code and deploys it.
Sees your mail: No, but code deployed from it could.
Reporting a vulnerability
Found a security flaw? We would rather hear it from you.
Email help@trupeo.com with SECURITY in the subject line. You can write in English or French. Include enough for us to reproduce it: the address or endpoint, the steps, and what you observed. A proof of concept helps; a video is not needed. If you believe the flaw exposes another user's data, say so in the first line, so it is looked at first.
What happens next
We acknowledge every report within 5 working days. ALK Innovations, the company behind Trupeo, is a small team, so that acknowledgement may be the only message you get until the issue is resolved. We will tell you when it is fixed, and if we decide not to fix it, we will tell you why.
If you have not heard from us within 10 working days, assume your email did not arrive and send it again. We do not currently run a paid bug bounty.
What is in scope
- app.trupeo.com: the application, and its API under /api/.
- trupeo.com and www.trupeo.com: this website.
- The workers that synchronize mailboxes, insofar as you can reach them through the product.
What is out of scope
We close these reports without a fix:
- Findings from an automated scanner with no demonstrated impact.
- Missing hardening headers on endpoints that serve no credentialed content.
- Denial of service through volume, getting around rate limits by using many source addresses, or anything that requires physical access to a user's device.
- Social engineering of ALK Innovations staff or of Trupeo users.
- Vulnerabilities in a third party Trupeo depends on: report those to that third party, and tell us too if Trupeo's configuration makes them exploitable.
- Anything that requires a user to have already installed malware or handed over their password.
Rules for security testing
Test against accounts you own. Anyone can create a Trupeo account at app.trupeo.com, with a 30-day free trial and no card, so there is no need to touch anyone else's data, and a report that does is no longer made in good faith or in scope.
Do not run load or stress tests, and do not change or delete data you did not create. If showing the flaw would mean reading another user's mailbox, stop at the point where you have shown you could, and tell us that instead.
We will not pursue legal action over research that follows these rules and that reports privately.
Keep your mailbox and answer together.
Trupeo turns the address your team already uses into a clear place to assign emails, add notes, and see what has been answered.
Create an account30-day free trial, no credit card required.