Current safeguards
- Encrypted HTTPS delivery through the hosting platform.
- Server-side validation, payload limits and rate limiting on sensitive public endpoints.
- Restricted file types and sizes for résumé and conversion workflows.
- Browser-local processing for tools explicitly marked as local.
- AI Inbox uses Google OAuth with PKCE and state validation; LordXTech does not collect Google passwords.
- Gmail access and refresh tokens are encrypted with AES-256-GCM before database storage.
- AI Inbox sessions use secure HTTP-only cookies and store only a hash of the session token.
- Mailbox tables are server-only, row-level security is forced, and browser roles receive no direct table access.
- Sending requires an explicit reviewed-reply confirmation; AI actions run only after a user request.
- Disconnect attempts Google token revocation and deletes the account's synchronized mailbox records.
- Backend credentials remain in server-side environment configuration and are not shipped in browser code.
- Operational logs and performance monitoring designed to avoid recording submitted message content.
Your role in protecting information
Do not submit secrets or highly sensitive information through public forms, chat or utilities. Verify the destination before uploading a document, keep backups of important files and review AI-generated or converted outputs.
Connect only Gmail accounts you are authorized to use. Review recipients, facts, dates, commitments and confidential information before sending any reply. Public availability remains subject to Google OAuth verification and any restricted-scope security assessment Google requires.
Mailbox users can review the dedicated AI Inbox Data Use & Deletion Guide before connecting an account.
Report a vulnerability
If you believe you found a security issue, email support@lordxtech.com with “Security report” in the subject. Include the affected URL, a clear description, reproducible steps and potential impact. Do not include unrelated personal data.
Responsible research
Please avoid privacy violations, service disruption, social engineering, automated high-volume testing and accessing or modifying data that is not yours. Allow reasonable time for investigation before public disclosure.
No certification claim
This page describes current operational practices and does not claim that LordXTech is certified under a particular security standard unless a certification is explicitly published.