Protecting account access
Production connections to Trackable use HTTPS. Sign-in sessions are stored in authenticated encrypted cookies, using AES-256-GCM. Session cookies use HttpOnly, Secure in production and SameSite=Lax to reduce cross-site cookie exposure.
Server-side session and workspace ownership checks restrict account data and connection operations. Google and Discord sign-in use provider identity verification and protections that bind authorization responses to the browser that started the flow.
Use a secure email account and enable multi-factor authentication with your email or identity provider. Never share a Trackable login code or use a shared business inbox as a substitute for individual account security.
Connected inbox credentials
Saved IMAP credentials and mailbox OAuth refresh credentials are held in a private encrypted credential vault. Browser roles cannot directly read the stored secrets. Background workers receive the credentials or short-lived tokens needed to perform authorized work.
Gmail and Outlook connections request read-only mailbox permissions. Trackable does not request permission through these connections to send, delete or modify your messages. Custom IMAP connections use credentials you provide; use a dedicated app password where your provider supports one.
Disconnect an inbox in Integrations when you no longer want imports. You can also revoke access in the provider account. See how each disconnect option works.
Security has limits
Trackable is in private beta. These controls reduce risk; they do not guarantee that a service is free from vulnerabilities, outages or unauthorized access. This page does not claim a security certification, independent penetration-test certification or universal multi-factor authentication enforcement.
Bank connections are not live. Publishing this page does not mean that a production bank integration or its operating requirements have been completed.
Exports, shared recap images and calendar subscription links can expose information outside Trackable. Keep private links confidential and review what a card or download includes before sharing it.
Report a security concern
Email support@trackable.co with the subject “Security report.” Include the affected page or feature, what happened, approximate time and safe steps to reproduce the issue.
Do not send passwords, access tokens, payment-card details or copies of another person’s private records. If you encounter someone else’s information, stop accessing it and describe the issue without retaining or sharing that information.
This reporting channel does not authorize testing other users’ accounts, disrupting the service, social engineering or accessing data without permission. Contact us before testing that could affect users or production systems. No bug-bounty reward or response-time guarantee is offered by this page.