You want to check. Here is everything we know.
The full account, section by section, with the dates and the sources. The short version is on the security page.
Who checked Trupeo?
Checked by an outside lab, not only by us.
Google treats reading and managing a Gmail inbox as a restricted permission. An app like Trupeo, which uses it from its own servers, has to go through a security assessment by an independent lab. The program is called CASA.
TAC Security assesses Trupeo at level AL1. It is one of the labs authorized by the App Defense Alliance to carry out these assessments.
The review ends. TAC Security finds Trupeo in compliance across every control at level AL1.
Google approves Trupeo's verification for this access. Gmail no longer shows a warning screen when you connect your mailbox.
- Every year
A new assessment. It is not a one-off: Google asks for one at least every 12 months.
Where these rules come from
- Google: Gmail API scopes and their classification
- Google: restricted scope verification
- App Defense Alliance: authorized labs
These pages explain the rules. Trupeo's level, dates and result are not on them: they come from Google's and TAC Security's emails.
Where is my mail kept?
Your mail stays where it is.
Trupeo connects to the address you already have. Gmail, Microsoft 365 and Outlook go through Google's or Microsoft's own sign-in page; any other email provider, over IMAP.
Your mail stays with your email provider. Trupeo works from a copy of the emails it shows your team, stored at Microsoft Azure in France.
If you stop using Trupeo, your mailbox does not move and nothing in it is deleted.
- Your mailboxGmail, Outlook or your email provider. It stays where it is.
- A copy at TrupeoStored in France, encrypted.
- Your teamEach with their own account.
What Trupeo changes in your mailbox
Some of what your team does in Trupeo happens in your mailbox too.
For Gmail, Trupeo has no permission to delete an email permanently.
Who can get in?
Everyone signs in as themselves.
Each member of your team has their own Trupeo account, and a mailbox is shared only with the people its owners invite. Nobody has to pass the mailbox password around.
Two-step verification
It is a code from an authenticator app, with backup codes in case you lose your phone. Where you set it depends on how you sign in.
When the Trupeo team opens your account
Nobody at Trupeo reads your emails, except when you ask us to or where security or the law requires it.
When a member of the Trupeo team opens your account, it is recorded, with the date. No notification is sent: that list is the place to check.
The screen as it is in the app. The date is an example.
Each member sees only the times their own account was opened. When the Trupeo team opens another member's account, it reaches the same shared mailbox. A mailbox owner who wants the full picture can ask the other members to check their list too.
Where are the servers?
Stored in France, encrypted in transit and in storage.
Trupeo runs on Microsoft Azure. The database and the application servers are in France (Azure France Central region). Stored email bodies and attachments are there too.
Some service providers are not in France. They are listed in the privacy policy, section 5, and what each one sees is set out further down.
In transit
The site and the app are served over HTTPS only, and Trupeo's connections to Gmail and Microsoft are encrypted too.
Its connections to an IMAP or SMTP server are encrypted when that server offers it. Trupeo does not refuse a server that does not.
In storage
Azure encrypts the database and the file storage on its disks. Trupeo adds a layer of its own on top (AES-256-GCM), with a key for each mailbox, but not over everything:
| What is stored | Encrypted by Azure | Also encrypted by Trupeo |
|---|---|---|
| Your mailbox login details | Yes | Yes |
| The text of your emails and the attachments | Yes | Yessince 10 July 2026 |
| An email's subject, its addresses, the preview, a copy of its text kept for search, and what your team writes in Trupeo | Yes | No, Azure only |
- Your mailbox login detailsAzureYesTrupeo on topYes
- The text of your emails and the attachmentsAzureYesTrupeo on topYessince 10 July 2026
- An email's subject, its addresses, the preview, a copy of its text kept for search, and what your team writes in TrupeoAzureYesTrupeo on topNo
Copying a file out of storage is not enough to read it: the key is kept separately, in Azure Key Vault.
What about my payment details?
Your payment details go to Stripe, not to us.
Subscriptions and payments are handled by Stripe.
Which other services are involved?
The other services involved.
Trupeo relies on nine outside services. Six never see your mail. Here is what each one does, and what it can see.
They do not see your mail(6)
- StripeSubscriptions and payments.
- Cloudflare TurnstileKeeps bots away from the site's forms.
- Google AnalyticsMeasures how the site and the app are used.
- PostHogMeasures product use and records navigation, to see where people get stuck.Recording stops before your mailbox.
- Google ChatTells the Trupeo team when someone writes to them or uses the contact form.It only receives what you write to us.
- GitHubHolds Trupeo's source code and deploys it.It does not see your mail, but the code it deploys could.
They see part of it(1)
- Amazon SESSends the emails that come from Trupeo itself, such as account confirmations and notifications by email.A notification email can quote a conversation's subject and the name of the person who wrote, not the text of the email.
They see your mail(2)
- Microsoft AzureHosts Trupeo: application servers, database and file storage.It stores Trupeo's copy.
- Google, Microsoft and IMAP email providersWhere your mailbox already lives. Trupeo reads, sends and organizes email there for your team.Your mail is already there.
Now you know where your mail goes.
Connect your mailbox whenever you are ready. Your mail stays with your email provider, and you can stop at any time.
- No credit card
- Keep your address and your emails
- From €10 a month per mailbox, excl. VAT