Security

Quokka reads the most sensitive thing a small company has. These are the specific things we do about that, in plain words.

Every person's mail has its own key

Not one key for the company. One for each person. Their messages are locked with it and nothing else opens them.

Erasing somebody really erases them

On a genuine erasure request we destroy their key. Their mail becomes meaningless everywhere at once, including in every backup ever taken, permanently, for everyone including us. There is no spare key, because we never made one.

But someone leaving does not erase the company's history

When a rep leaves they lose access immediately and nothing new is read from their accounts. What they already sent stays readable, because whoever picks up their deals needs to see what was agreed. Losing access and losing the record are different things, and only a deliberate erasure request does the second.

Customers are separated by the database, not by our code

Postgres itself refuses to return one customer's rows to another, even if our own code asks wrongly. We test this on every build: an unscoped read returns nothing, and a cross-customer write is rejected outright.

Personal mail is never read

Medical, financial, job-hunting and personal threads are excluded from the sender and subject line alone, before anything opens the message. Reading the body to decide whether you should read the body is not privacy.

Every fact has a receipt

Nothing is stored that cannot be traced to the exact message it came from. If it cannot be traced, it is not stored.

Every read, answer and action is logged

Searchable by your own administrator. A trust claim you cannot check is just a sentence on a website.

Nothing sends itself

Quokka drafts replies. A person reads the exact words and presses send. There is no setting that changes this.

No third-party trackers

No analytics scripts, no advertising pixels, no tag managers. The browser is told, by policy, to refuse them.