Security and Data Policy

1.1 No mailbox passwords

Forwarding setup does not ask for your mailbox password. You configure a selective forwarding rule that you control and can remove. Existing separately authorized mailbox connections and optional encrypted application authenticator keys are described in the Privacy Policy.

1.2 Verified sources only

You must verify the source mailbox before completing forwarding setup. HeyPass checks signed ingress, routing and sender authentication. Direct authenticated sender checks and, where enabled, tightly restricted ARC evidence follow the account's approved trust policy. A forwarded display name or quoted header alone does not prove the original sender's identity.

1.3 Blocked messages

HeyPass always blocks password-reset and account-recovery emails. It also blocks mail from known banks and payment providers. You cannot turn these blocks off.

1.4 One request, one person

A verification is delivered only for an eligible member's active request made before arrival. One member holds a request at a time; others can wait in a queue. Codes sent by email cannot be recalled. In-app links expire in memory within five minutes and are cleared on use where applicable. The provider controls its credential and session expiry.

1.5 Encryption

HeyPass's public web service uses HTTPS. Stored secrets such as supported connection credentials and application authenticator keys are encrypted under the relevant key controls. Authentication challenges are hashed. This is not a promise that every database field, backup or provider-held copy is encrypted or deleted under the same lifecycle.

1.6 Access control

You can protect your HeyPass account with an authenticator app or a passkey. Owners and admins should always turn this on. Each workspace's data is kept apart from other workspaces. Our staff can access workspace data only to fix a problem you report, or to investigate abuse or a security issue.

1.7 Analytics on sensitive screens

We do not record sessions on screens that show verifications, sample emails or sign-in steps. We do not send codes or message content to analytics tools.

1.8 Reporting a security issue

If you find a security problem, email hello@heypass.io with the subject "Security report". Please give us time to fix it before you share it in public.

1.9 Certifications

HeyPass does not hold a SOC 2 or ISO 27001 certificate at this time. If that changes, we will say so on this page.

2.1 Removing a member

When you remove a member, they can no longer request codes from HeyPass. This does not sign them out of any third-party service. It also does not change any password they know. Do both at the provider when a person leaves.

2.2 Removing a connected account

Removing a connected account stops future delivery. Delete its selective forwarding filter in the source mailbox as well. The organization's receiving address can be shared by other configured apps, so do not remove a shared destination still in use. Received message bodies are processed transiently; rejection metadata follows the 24-hour policy.

2.3 Deleting a workspace

A workspace owner can schedule deletion in workspace Settings under Delete workspace. Access is suspended immediately, and there is a seven-day undo window. Undo does not restart requests or delivery.

After that window, maintenance purges the live workspace directory and central routing/membership records. Errors keep access suspended and are retried. A minimal deletion tombstone and permanent receiving-address reservation remain so deleted workspaces are not reopened and addresses are never reassigned. Older backups, provider-held records and personal-account deletion require separate operator coordination. This policy does not promise a verified 90-day automatic backup purge.

2.4 Deleting your personal account

Request deletion of your personal HeyPass account at hello@heypass.io. Workspace ownership and membership must be resolved before deletion. Support will coordinate the required workspace and retained-record steps.

2.5 Copies we do not control

We cannot delete the original messages in your own mailbox. We also cannot delete copies that your mail provider keeps. Those copies follow that provider's rules.

2.6 Export

Before you delete a workspace, you can ask us to export your workspace settings and request records. Email hello@heypass.io and we will send them within 14 days.

3.1 How data moves through HeyPass

1. A member asks HeyPass for the next verification for one connected account. HeyPass opens a request for that member.
2. The member starts the sign-in at the third-party service. The service sends a verification email to your organization's mailbox.
3. Your auto-forwarding rule sends that email to the relay address HeyPass created for your workspace.
4. HeyPass checks the verified source, signed ingress, routing and approved sender-authentication policy.
5. HeyPass evaluates the permitted login purpose and format and matches the eligible open request and permissions.
6. HeyPass delivers an eligible code to the chosen destination or lets the requester claim a supported link. In-app links expire in memory within five minutes; already delivered credentials cannot be recalled.
7. HeyPass saves content-free request metadata. Mail bodies and credentials are processed transiently; rejected-message metadata has a 24-hour policy and request history a 30-day policy.

3.2 Controls and the promises they support

3.3 Where data is processed

The Subprocessor List in our Privacy Policy shows where each provider processes data. Each provider gets only the data it needs. For example, Dodo Payments receives billing details but never sees forwarded mail. Mailgun receives forwarded mail but never sees your payment details.

3.4 Retention at a glance

Received mail bodies and credentials are transient. In-app links and forwarding-confirmation values expire in memory within five minutes. Rejection metadata and structural failed previews have a 24-hour policy; request/security history has a 30-day policy, with maintenance margins.

Saved configuration, account/security records, backups and provider copies have separate lifecycles described in the Privacy Policy. Contact hello@heypass.io to coordinate deletion or discuss retention requirements.

3.5 Our commitment

HeyPass does not hold a SOC 2 or ISO 27001 certificate at this time. We follow the controls on this page and review them when the product changes. We never sell your data, and we keep each customer's data apart. If a change to our security affects you, or if an incident affects your data, we will tell you.