Security is part of the architecture

Infrastructure

The platform runs on infrastructure we operate, including the mail transfer agents that deliver your messages. Internal services communicate over private networks; only the web application, API and mail ports are exposed publicly. Hosts are firewalled, protected by Fail2ban and patched on a documented schedule.

Credentials and secrets

• Passwords are hashed with Argon2id.
• API keys and SMTP passwords are shown once and stored only as hashes.
• DKIM private keys, webhook signing secrets and 2FA seeds are encrypted at rest with AES-256-GCM.
• Secrets are redacted from application logs.

Accounts

• TOTP two-factor authentication with single-use recovery codes.
• HttpOnly, SameSite session cookies, CSRF defenses and device session revocation.
• Role-based access for your team, and an audit log of sensitive actions.
• Account lockout after repeated failed sign-ins.

Tenant isolation

Every query for customer data is scoped to the organization derived from your authenticated session or API key — never from an identifier supplied in the request. Isolation is covered by automated tests.

Email authentication

Every message is DKIM-signed with your domain's key, and sending is only possible from domains whose ownership, SPF and DKIM records have been verified. The SMTP service is not an open relay: authentication and sender authorization are required for every message.

Webhooks

Webhook requests are signed with HMAC-SHA256 and include a timestamp for replay protection. Endpoints resolving to private, loopback or cloud-metadata addresses are refused to prevent server-side request forgery.

Reporting a vulnerability

Please report security issues to [email protected] with the subject “Security report”. We investigate every credible report and will keep you informed.