We are not asking you to take our word for it.
An independent lab examined Trupeo in September 2026. Here is its verdict, then what we do every day to protect your mail.
The full account, dated and sourced20 control groups. No failures.
Trupeo has been compliant with CASA AL1 since 11 September 2026.
- Lab
- TAC Security, authorized by the App Defense Alliance
- Tested
- 10 September 2026, report issued the 11th
- Next
- A new assessment every year
Trupeo's three commitments
Checked from the outside
An independent lab examined Trupeo, and the assessment comes round again every year.
Data stored in France
Trupeo's database and what it keeps of your emails, attachments included, are stored in France. See our service providers
Never sold, never fed to an AI
Your mail is only ever used to give you the service. Never for anything else.
Your mail does not move.
Trupeo connects to the address you already have and works from a copy stored in France. Your mailbox stays with Gmail, Outlook or your email provider.
If you stop using Trupeo, it does not move and nothing in it is deleted.
Google approved this access on 19 September 2026. Gmail no longer shows a warning screen when you connect your mailbox.
- Your mailboxGmail, Outlook or your email provider. It stays where it is.
- A copy at TrupeoStored in France, encrypted.
- Your teamEach with their own account.
What we actually do.
Each measure sits at the step of the journey it protects, and is set out with its limits on the detail page.
Your mailbox
Gmail, Outlook or your email provider. It stays where it is.
Everyone signs in as themselves
The mailbox password stops circulating in the team.
On Gmail, Trupeo cannot delete an email for good
That permission was never asked for, so it cannot be used.
A copy at Trupeo
Stored in France, encrypted.
Encrypted in storage and in transit
Azure encrypts the database and the files. Since 10 July 2026, Trupeo also encrypts the text of your emails and the attachments, with a key for each mailbox. Exchanges with your email provider are encrypted when it offers it.
Copying a file is not enough to read it
The key is kept separately, in a vault of its own, away from the storage.
The restore has been rehearsed, not just written down
On 3 September 2026, a restored database was read back and decrypted with the real key.
Your team
Each with their own account.
Two-step verification
A code from an authenticator app, and ten backup codes in case you lose your phone.
Every time the Trupeo team opens your account, it is recorded
You find each opening and its date in your settings, in the Trupeo team access section.
Your payment details go to Stripe
They never pass through Trupeo's servers.
Where to go next, depending on what you came for.
- See the full accountEvery measure above, with its limits, its dates and its sources.
- The services involvedTrupeo relies on nine outside services. Six never see your mail.
- Report a flawFound a security problem? Here is how to tell us.
A question this page does not answer? Write to us
Your data protection officer is asking for our data processing agreement? It is published here
Now you know where your mail goes.
Connect your mailbox, invite someone from your team and see what it changes on your real emails. You can stop at any time.
- No credit card
- Keep your address and your emails
- From €10 a month per mailbox, excl. VAT