Your data security is our top priority. We've built Delegate from the ground up with encryption, access controls, and privacy protections so you can work confidently.
We treat security not as an afterthought but as a fundamental property of everything we build. Your workspace contains sensitive emails, tasks, and business data — that responsibility shapes every architectural decision we make.
Delegate uses industry-standard encryption in transit and at rest, OAuth 2.0 for authentication, role-based access controls, and a self-host option that gives you complete data sovereignty.
Multiple layers of protection work together to keep your workspace and your data safe.
All data stored in PostgreSQL is encrypted at the volume level using AES-256. Your emails, tasks, and workspace data are never stored in plaintext on disk.
Every connection between your browser, the Delegate server, and third-party APIs is secured with TLS 1.3. We enforce HTTPS everywhere — no plain HTTP fallbacks.
Delegate authenticates users via Google OAuth 2.0 and issues short-lived JWT sessions. We never store plaintext passwords — credentials-based accounts use bcrypt hashing.
Every workspace enforces four roles: Owner, Admin, Member, and Viewer. API routes check session ownership before touching any workspace resource — no cross-tenant data leaks.
Admin actions including impersonation, plan changes, and billing operations are logged with actor identity, timestamp, and affected resource for full traceability.
Deploy Delegate on your own infrastructure using Docker Compose. Your data never leaves your environment — full data sovereignty with no dependency on our cloud.
Delegate runs on Next.js 14 with a standalone output, backed by PostgreSQL 16 via Prisma ORM. The architecture is cloud-agnostic — deployable on any major cloud provider or on-premises without modifying a single line of application code.
Transparency about what data we process and how it is used is a core part of our security posture.
Delegate is architected with GDPR principles in mind — lawful processing, data minimisation, and the right to erasure are built into the data model, not patched on afterward.
SOC 2 Type II certification is in progress. Self-hosted deployments allow enterprise customers to satisfy internal compliance requirements without any data leaving their infrastructure.
We take all security reports seriously. If you discover a potential security issue in Delegate — whether it's the hosted product or the open-source codebase — please report it privately so we can address it before any public disclosure.
Email your findings to security@delegate.ws with a description of the vulnerability, steps to reproduce, and the potential impact.
Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and ship a fix — typically within 90 days of the initial report.
We will acknowledge your report within 48 hours and keep you updated throughout the remediation process. We credit researchers who report valid vulnerabilities in our release notes.
Reach out with any questions about our security practices, compliance posture, or self-hosting options.
14-day free trial. No credit card required.