SECURITY & RESPONSIBILITY
Our security approach
Security is a set of responsibilities across identity, data, actions and operations. Here is how the documented product controls and our implementation approach relate to those responsibilities.
Identity and administrative responsibility
Oneemail supports two-factor sign-in, dedicated mail-client app passwords and session management. Everyday mailbox use and organization administration are separate, and administrative roles serve different operational responsibilities.
Business-software implementations use staff capabilities and company association to scope records and actions. An implementation's access rules should be agreed and verified against the real users and their responsibilities.
Documents, credentials and audit context
Oneesys describes versioned documents, restricted folders and confidential-record controls. Credential storage is treated separately, with encrypted values and deliberate reveal actions recorded against a person and reason.
Private storage links, document permissions and activity records need to work across search, folders, linked records and downloads. These controls should be checked in the context of the enabled implementation.
Encryption with its scope made clear
Oneemail documents encrypted Drive storage using Amazon S3 and AWS KMS. Chat has its own end-to-end encryption. Optional OpenPGP and S/MIME email encryption depends on keys, clients, recipients and configuration.
Encryption in transit, encryption at rest and end-to-end encryption solve different problems. We avoid presenting them as interchangeable, and we review the relevant recovery and key requirements during product setup.
AI, confirmation and human judgment
Oneesys bill scanning produces drafts for review, with confidence and arithmetic checks. A person confirms the extracted information before an operational posting.
OneeAI implementations define approved knowledge, permitted workflow actions, customer identity and human handover. Important decisions retain the review and authorization appropriate to the business.
This website's controls
The inquiry form uses server-side validation, bounded requests and temporary rate limits. Its delivery credential remains in server configuration. The optional assistant requires an explicit open action before its external script connects, and analytics scripts are not requested until you accept analytics.
The site applies request and browser security headers appropriate to its configuration. Website implementation does not by itself establish a certification, a product-wide guarantee or a contractual service-level commitment.
Operating requirements
Hosting, logging, backups, retention, incident response and recovery requirements are reviewed for each product or project. A site's public description does not replace a service agreement or an assessment of your organization's obligations.
The tools and cloud services we select follow the actual workload. Ask for the deployment and data-handling details that apply to the specific service you plan to use.
Report a security issue
Email info@oneewaee.com with a concise description, the affected public URL and safe reproduction details. Do not send passwords, private keys or another user's personal data. Avoid disruptive testing and unauthorized access while reporting an issue.
Questions?
Contact info@oneewaee.com about this website or the policies for a particular product or service.