Policies and documents
Security
Send-only Gmail access, encrypted tokens, hashed keys, signed links and per-workspace isolation.
Privacy policy
What Pedibee stores, why, who else touches it and what you can ask us to do with it.
Terms of service
The agreement between your company and Pedibee for the product, the API and the MCP server.
Acceptable use
What every workspace may and may not send, and what happens when the rules are broken.
Data processing agreement
For customers who need a signed agreement for the contact data they keep in Pedibee.
For email recipients
Got an email sent with Pedibee? How to stop it, find out who sent it, or report it.
Report a vulnerability
Found a security issue? Tell us privately and a person on the team will reply.
Pedibee at a glance
How it works under the hood
- Gmail is connected with send-only permission. Pedibee cannot read, search or delete mail.
- Gmail tokens are encrypted with AES-256-GCM. API keys and assistant tokens are stored only as hashes.
- Every record belongs to one workspace, and every request checks the person still belongs to it.
- Tracking and unsubscribe links are signed, so they cannot be forged or reused.
- Every campaign and sequence carries a one-click unsubscribe, and every send checks the do-not-email list.
- The API runs on Google Cloud in the United States, with Cloudflare in front of tracking domains.
Running a security review?
Send us your questionnaire or ask for a data processing agreement and a person on the team will reply. security@pedibee.com