Security

Where your data is

Every message is dispatched through Amazon SES in London (eu-west-2). That is the region the code configures and the region the message headers will show you.

The rest of the stack is a set of managed platforms, listed with their locations in the Privacy Policy: Amazon Web Services, Convex, Clerk, Vercel, Stripe, Sentry.

What we do not claim. Sending is in the UK. Storage residency at rest for the application database is not something we have in writing from our provider yet, so we do not assert it. If UK residency at rest is a hard requirement for you, ask us before you build — we would rather lose the deal than have you discover this in an audit.

Who can reach it

• Tenant isolation. Every row carries an account identifier and every query is scoped to it. This is enforced at the data layer, not by the UI.
• API keys. Stored only as SHA-256 hashes — we cannot recover one and neither can anyone who reads the database. A key is displayed once, at creation. Keys carry a scope: a send-only key is rejected by every read and management endpoint, so the credential you paste into a third-party tool cannot list your mail.
• Dashboard access. Authentication is handled by Clerk; we never see or store a password.
• Administrative access. Our own admin console requires an identity whose email address is both verified and on an explicit allowlist. With that allowlist unset it denies everyone, including us — it fails closed, not open. Every state-changing admin action is written to an audit log.

Protecting the API and your integration

• Signed webhooks. Deliveries carry an HMAC-SHA256 signature over the timestamp and raw body, with a five-minute tolerance to blunt replay. Verify it before you act on a payload — our SDK ships the check.
• Webhook URL validation. Endpoints are checked before they are saved and again against the resolved IP at delivery time, so a webhook cannot be pointed at a private network, loopback, or a cloud metadata address.
• Header injection is closed. Custom headers and subject lines reject control characters, and security-relevant headers cannot be overridden.
• Address parsing fails closed. A display name cannot be used to smuggle a different sending address past the domain ownership check.
• Browser hardening. The dashboard sets a Content-Security-Policy, denies framing, and sends HSTS and a deny-by-default permissions policy. There is no third-party analytics or advertising script anywhere on the site.

Data you control

• Retention. Choose indefinite, 365, 90 or 30 days. Past your window, message bodies and attachments are stripped automatically while the delivery record survives, so shortening retention does not cost you your statistics.
• Export. One click produces a JSON file of your account, domains, suppressions, webhooks, usage and message metadata. If any part had to be capped, the export tells you which.
• Deletion. Self-serve and genuine: sending identities, the payment record, every row belonging to your account, then your login — in that order, so a failure part-way cannot lock you out of an account that still holds data.
• Log redaction. Request logs are kept 30 days on a fixed schedule outside your retention setting, so recipient addresses are redacted from them.

Compliance — where we actually are

We are not SOC 2 or ISO 27001 certified. We are a small team pre-revenue, and a certification bought at this size measures the audit, not the engineering. We would rather tell you that than let you find out during procurement.

What exists today: a UK GDPR Article 28 Data Processing Agreement you can accept without a negotiation, a named sub-processor list with 30 days' notice before it changes, self-serve export and deletion, and the controls above. If your review needs something we do not have, ask — a straight answer is faster for both of us.

Reporting a vulnerability

If you have found a security issue, tell us before you tell anyone else and we will work with you. Email security@yourmail.dev with details and reproduction steps; we aim to acknowledge within 72 hours. We do not run a paid bounty programme yet, and we will not pretend otherwise — we will credit you if you want the credit.