Encryption in transit
TLS is required for SMTP submission and the dashboard. Mail to receiving servers uses TLS whenever they support it, with DANE validation where published.
Security
Your email is your users' trust. We treat it that way.
Security is part of the architecture, not a checklist added later. Here is how the platform protects your account, your credentials and your messages.
Secrets encrypted at rest
DKIM private keys, webhook secrets and two-factor secrets are envelope-encrypted with keys kept separate from the database.
Hashed credentials
Account passwords use Argon2. SMTP passwords and API keys are stored only as hashes and shown once at creation.
Least-privilege access
Workspace roles, credential scoping to domains and IPs, and per-tenant database isolation enforced by row-level security.
Signed everything
Webhooks are HMAC-signed with replay protection; our sending servers authenticate every request to the control plane with Ed25519 signatures.
Audit trail
Sensitive actions (credential changes, key reveals, admin actions) are recorded in an append-only audit log.
Disclosure
Report a vulnerability
If you believe you have found a security issue, email [email protected] with the subject "Security disclosure". Please include steps to reproduce and give us reasonable time to fix the issue before sharing it publicly.
- Do not access, modify or delete data that is not yours.
- Do not run denial-of-service tests or send spam through the platform.
- Do not use social engineering against our team or customers.
We will acknowledge your report, keep you updated, and credit you if you wish once the issue is resolved. We will not take legal action against good-faith research that follows these guidelines.