Security and data location
Your backups hold a full copy of your company’s mail. This page explains where it is stored, who can read it, and how it is protected.
Where your backups are
Backups are stored in France, in OVHcloud object storage, under our own account. Another region is possible on request, for a client whose obligations require it.
Your messages do not pass through any third country, and no American provider holds them.
OVHcloud encrypts the stored backups at rest. istorel does not add its own encryption layer: there is no client-side or end-to-end encryption.
Replicated across three zones
Everything we write is replicated across three independent availability zones in the same region. These are three separate buildings, each with its own power and network. Losing a whole datacentre does not lose any data.
This is the only durability level we offer. We used to have a cheaper single-zone option and removed it, because a backup must still be there when something goes badly wrong.
- They protect against hardware failure, fire, flood and the loss of a whole site.
- They do not protect against a deletion, because a deletion is replicated like any other change. The backup covers that case: a message deleted from your mail server stays in istorel.
Your mail credentials
The application password of each mailbox is encrypted before it is stored, with a key kept in the environment, never in the database. It is decrypted only when istorel connects, and it is never shown again. To change it, you enter a new one.
istorel connects to your mail server in read-only mode. It never opens a session that can write or delete. If our service were compromised, an attacker could read your mail through it but could not delete anything.
Card numbers never reach us. The card form is Stripe’s, and we store no card data that could be reused.
Who can read what
Account passwords are hashed with argon2id. Sessions can be revoked, and changing a password ends all of that person’s sessions, including the current one.
Within your account, three levels limit what each person sees: the whole account, one organisation, or selected mailboxes. Access to a mailbox means access to its content, and the interface reminds you of this before you confirm.
Two-factor authentication with an authenticator app is planned but not available yet.
Deleting an account
When you ask for deletion, a closing invoice is charged for what was used since the start of the current period: mailboxes added and storage above the included amount. Backups then stop immediately, and billing stops with them. Your data stays available for download for fourteen days, then everything is destroyed: index, packs, bucket and log.
A link in the confirmation email cancels the request, up to the last day. You can also ask for immediate destruction, in five explicit steps, because the data cannot be recovered afterwards.
We keep your invoices, because accounting law requires it. We keep nothing else.