WIRESNAREGet Started

Security & Trust

Security and trust

Last updated August 19, 2026

WireSnare uses AI-assisted analysis to review selected message content for payment-fraud and email-impersonation patterns. You control scanning. The inbox stays with Google or Microsoft. This page is the current public summary for buyers going through a vendor review.

How access works

  • Read-only mailbox access. You connect Gmail or Outlook. WireSnare can read mail in that mailbox to look for payment scams. It cannot send, delete, or move mail, and it cannot access your bank.
  • Inbox stays put. Mail is not forwarded into a new inbox. Messages remain at Google or Microsoft.
  • Selected content is processed for analysis. Message content from the mailbox you connect may be processed to produce review flags. Those flags can be incomplete or incorrect and do not replace independent verification.
  • You control scanning. Pause scanning anytime from settings. Disconnect the mailbox to stop access. No new flags are created while scanning is off.
  • Your firm cannot open the inbox. Connecting a mailbox does not give colleagues a way to browse that inbox.

Encryption

  • In transit: Traffic between the web app, mailbox providers, and our systems uses TLS. HSTS is enabled on wiresnare.com.
  • At rest: Account data and scan results stored by WireSnare are encrypted at rest.
  • Secrets: Service credentials are stored in a secret manager and rotated on staff turnover. No credentials in source control.

Who we work with

Third parties involved in delivering the product. Customers who sign a Data Processing Addendum get notice before we add a new provider to this list. Additional infrastructure providers process data in the United States under contract. Details are available to customers on request.

Google

Purpose
Gmail mailbox access and sign-in for Google users
Data accessed
Mail in the Gmail mailbox you connect, plus the email address used to sign in
Region
Depends on the Google account
Note
Read-only access to the mailbox you authorize. WireSnare cannot send, delete, or move mail.

Microsoft

Purpose
Outlook mailbox access and sign-in for Microsoft users
Data accessed
Mail in the Outlook mailbox you connect, plus the email address used to sign in
Region
Depends on the Microsoft account
Note
Read-only access to the mailbox you authorize. WireSnare cannot send, delete, or move mail.

Stripe

Purpose
Payment processing and subscription management (when billing goes live)
Data accessed
Billing email, payment method, subscription status
Region
United States
Note
Card data is handled by Stripe. It does not pass through WireSnare systems.

Data retention

  • Scan results (sender, subject, and a summary of why a message was flagged) stay with the account so later mail can be checked in context.
  • Email bodies are used to scan and are not kept as a permanent archive.
  • Attachments may be read when they contain payment instructions. File bytes are not stored.
  • Sign-in logs retained for 90 days.
  • Account deletion: email hello@wiresnare.com. Deletion completes within seven business days.

Incident response

If a security incident affects your data, we notify you within 72 hours of confirmation. Notification includes what happened, what data was affected, what we have done, and what you should do.

For vulnerability disclosures, contact security@wiresnare.com. We reply within one business day and coordinate a fix and disclosure timeline. We do not run a bug bounty today, but we publicly credit responsible reporters on request.

Compliance

  • SOC 2: not certified today. A Type I report is on the roadmap for late 2026.
  • GDPR / UK GDPR: we honor data subject rights (access, correction, deletion, portability). A data processing addendum is available.
  • CCPA / CPRA and US state privacy laws: we honor consumer rights under CA, CO, CT, VA, and other applicable state privacy laws.
  • HIPAA: WireSnare is not a HIPAA covered entity or business associate. Do not use WireSnare to process protected health information.
  • Payments: WireSnare does not store cardholder data. Payments are handled by Stripe.

Vendor security review

This page covers most standard questions. The data processing addendum is public. For a questionnaire response, a signed DPA, or other review materials, email security@wiresnare.com. We reply within one business day.

Contact