_Last reviewed: 2026-09-15_

This page describes how to reach Codelynx about security and personal-data incidents. It does not claim ISO, SOC, or other certifications. Organization owners and administrators can accept and download the current [Data Processing Agreement](/docs/legal/dpa).

## Contacts

| Purpose                                              | Address                                                                |
| ---------------------------------------------------- | ---------------------------------------------------------------------- |
| Privacy, DSAR follow-up, incident notice to Codelynx | [help@codelynx.dev](mailto:help@codelynx.dev)                          |
| Product support                                      | [contact@lumail.io](mailto:contact@lumail.io)                          |
| Operator                                             | Codelynx, LLC, 8 The Green STE B, Dover, Delaware 19901, United States |

## Vulnerability reports

Email [help@codelynx.dev](mailto:help@codelynx.dev) with a description, affected URL or API, and reproduction notes. Do not include secrets or customer personal data beyond the minimum needed to demonstrate the issue. We do not operate a paid bug-bounty program.

## Customer incident updates

If Codelynx confirms a personal-data incident that affects subscriber or account data we process for a customer, we aim to notify that customer's organization **without undue delay** after confirmation. That processor-to-controller notice is separate from the customer's own deadline to notify a supervisory authority or data subjects.

We do not promise a fixed 72-hour customer SLA on this page. Statutory controller deadlines are the customer's obligation.

## Measures we actually operate

Documented, evidenced controls — not certifications:

- TLS in transit for the application and APIs
- Organization-scoped data access and API tokens with permissions
- Separate development and production environments
- Passwordless email OTP for Lumail accounts (OTP mail is untracked)
- Sent-email archives stored in Cloudflare R2; lawful erasure deletes known object keys
- Hatchet workers self-hosted in Nuremberg; Postgres in Frankfurt
- Bounce, complaint, and unsubscribe suppression to stop further sending

No service is completely secure. We cannot guarantee that unauthorized access, loss, or disclosure will never occur.

## What to do as a customer

1. Limit API-token permissions and rotate tokens after staff changes.
2. Use separate development and production tokens.
3. Enable native double opt-in before collecting marketing subscribers when that is appropriate for your market.
4. Leave transactional tracking off unless you have a documented reason to enable it.
5. Use lawful erasure for data-subject deletion; do not promise the disabled `DELETE` subscriber API.
6. Report suspected incidents to [help@codelynx.dev](mailto:help@codelynx.dev).