Security
Higgs Hub is built for teams whose inboxes hold other people's financial and legal lives. These are the controls behind that promise.
OAuth only — never passwords
Mailboxes connect through Google and Microsoft's own OAuth consent screens. Higgs Hub never sees or stores your email password, and you can revoke access from your Google or Microsoft account at any time.
Encryption at rest and in transit
OAuth refresh and access tokens are encrypted with AES-256-GCM before they touch the database, using a versioned key ring that supports rotation without downtime. Each ciphertext is cryptographically bound to its own workspace and mailbox row, so even a copied database value is useless anywhere else. All traffic is TLS with HSTS preload.
Tenant isolation on every call
Every MCP tool call resolves the caller's workspace membership and verifies the target mailbox belongs to it before any provider API is touched. Access tokens issued to MCP clients are short-lived (1 hour) with rotating refresh tokens.
Append-only audit trail
Every tool call an agent makes — successful, refused, or failed — is recorded in an append-only audit log, along with connects, disconnects, consents, API-key events, membership and billing changes, and which resource each call touched. If a client asks for a mailbox belonging to another workspace, the workspace that owns it is told. The log is visible to workspace owners and admins, because entries include other members' activity. Entries never include message content or credentials. Connections that fail before any credential is recognized are not recorded, deliberately — an audit write reachable without credentials would be an open door.
Real revocation
Disconnecting a Gmail mailbox revokes the grant at Google, not just in our database. Deleting a workspace or account revokes every grant it held. Nothing is ever deleted automatically — no scheduled job removes a mailbox because a subscription lapsed or a plan changed, so the only thing that destroys a grant is you asking for it.
Minimal logging, minimal dependencies
Application logs never contain OAuth tokens, mailbox search queries, or the contents of your email. The dependency surface is deliberately small and pinned, and the Google integration is undergoing CASA (Cloud Application Security Assessment) verification required for restricted Gmail scopes.
The assistant on this website
The chat box on higgshub.pro is a sales assistant. It has no mailbox access, no connection to any workspace, and no route to your mail — it answers questions about the product. What you type into it, and its replies, are stored for 90 days so we can see what visitors are asking, then deleted. Please don't paste anything confidential into it. This is the one place on the site where we keep what you typed, and it is deliberately separate from the audit log described above.