Trust

Security at Memo.

Memo is built so your email work stays private to your workspace and moves through deliberate quality gates before it leaves your hands. This page describes controls that are implemented today - not aspirations. We do not claim certifications or audits we don’t hold.

Security Approach

Memo favors least privilege, server-side enforcement, and honest boundaries over broad marketing claims.

Access is deny-by-default: you only reach data in workspaces you belong to.
The public marketing, docs, and trust pages are isolated from the authenticated app and never load tenant data or secrets.

Access and Tenant Isolation

Memo’s data model is User → Organization → Workspace, and access is scoped to the workspace you’re in.

Tenancy tables enforce row-level security with deny-by-default policies.
Cross-tenant isolation is verified by an automated SQL test matrix.
Brand assets are private and stored under tenant-namespaced keys with scoped, expiring access links.

Authentication and Authorization

Identity is handled by an established authentication provider; authorization is enforced on the server for every write.

Organization and workspace roles gate who can edit, approve, export, and administer.
All writes go through server-side authorization checks; client UI state is never the source of truth.
Invitations are single-use and expire.

Data Handling

Memo stores the work you create: workspace and account data, template content, brand assets, version snapshots, test-send records, and support submissions.

Account-level actions are recorded in an append-only audit event log.
Editor documents are validated server-side; raw HTML, scripts, and unsafe links/assets are not persisted.

Email Output and Test-Send Controls

Memo designs and reviews email; it does not do bulk sending. The one delivery path - test send - is deliberately narrow.

Controlled internal test sends require an approved version, a verified sender, and internal recipients only.
Test sends are clearly marked, rate-limited, and idempotent, with honest status and no tracking.

Preflight and Quality Gates

A server-authoritative preflight engine runs before sensitive actions and fails closed.

Approval, export, and test send are gated on a passing preflight for the exact version content.
Quality gates are recomputed in the database and are content-hash and rule-set-version aware.

Responsible Disclosure

If you believe you have discovered a security vulnerability in Memo, please report it promptly to our security team. Do not include sensitive information, customer data, or live credentials in initial reports - provide enough detail for us to reproduce the issue safely. We do not currently operate a paid bounty program, and we do not promise specific response timelines, compensation, or legal safe harbor beyond what is stated in our Vulnerability Disclosure Policy.

Report security issues to our team by email. Please don’t include sensitive information in initial reports.

security@memo.ly

Service Status

Current service status and incident history are published on the status page.

Contact

Questions about security or privacy? Email hi@memo.ly.