Security

Security at Béluga.
Designed in, not bolted on.

Our security posture is shaped by the Loi 25, by the fact that we own and operate our hardware in Québec, and by the open-source foundations of every component we ship.

Encryption

  • In transit — TLS 1.2+ everywhere (web, IMAP, SMTP, CalDAV, CardDAV, Matrix, WebRTC), with automatically renewed certificates.
  • End to end — Convo conversations are end-to-end encrypted by default, attachments included. Even Béluga cannot read them.
  • At rest — Mail passwords are encrypted in the database (pgcrypto), migration credentials as well, and infrastructure secrets are encrypted (sops/age). Backups are encrypted on our machines before any off-site transfer.
  • Passwords — Béluga never stores your main password: authentication goes through Keycloak (OIDC + PKCE), and tokens never transit through your browser (BFF architecture).

Identity and access

  • Authentication via Keycloak 26 (OIDC + PKCE, fine-grained roles); SSO offered on the Entreprise plan.
  • Multi-factor authentication for every account: TOTP codes, recovery codes, and passkeys (Face ID, Touch ID, Windows Hello, hardware keys). Organizations can make it mandatory for all their members.
  • App-specific passwords for third-party clients (IMAP), individually revocable, never exposing the main password.
  • Organization policies: minimum password length, session expiry, allowed IP ranges.
  • hCaptcha protection on signup flows.

Infrastructure

  • Bare-metal servers owned by Technologies Shelter-Bay inc., located in Québec. No reliance on AWS Canada, GCP Canada or Azure Canada — those regions remain subject to the U.S. Cloud Act.
  • Self-hosted K3s orchestration; immutable container images built by continuous integration.
  • Dedicated edge gateway with an application firewall and automatic blocking of malicious behavior (CrowdSec). A kill switch can isolate the platform from the Internet without touching the data.
  • Administration reachable only over VPN (WireGuard) — admin consoles are not exposed to the Internet.
  • Dedicated, isolated machines for email and video conferencing.
  • Daily backups with point-in-time recovery, kept 30 days; client-side-encrypted off-site copy, in Québec.

Monitoring and incident response

  • Application errors monitored via GlitchTip (open-source Sentry alternative), self-hosted.
  • Metrics, logs and alerts aggregated via Prometheus / Grafana / Loki.
  • Public status page hosted outside our own infrastructure, so it stays up during a major outage.
  • Incident response plan aligned with Loi 25 notification requirements.

Compliance — where we stand, frankly

  • Loi 25 compliant by default — personal information stays in Québec for standard usage. Two documented exceptions: payments (Stripe) and transcription of recorded meetings (Mistral AI, France), covered by a privacy impact assessment.
  • Out of reach of the U.S. Cloud Act and FISA 702 — no U.S. parent company, no U.S. subsidiary.
  • Data Processing Agreement (DPA) available in French, governed by the Civil Code of Québec.
  • No SOC 2 or ISO 27001 certification to date. We are a young company in open beta; we document our security publicly on this page rather than display logos we don't have. An independent external security audit is planned after the public launch.

Reporting a vulnerability

Please email security@beluga.quebec. We acknowledge reports within 48 hours and provide a remediation timeline within five business days.