Encryption in transit
Public API and dashboard endpoints use HTTPS. Email transport encryption also depends on the receiving mail server; delivery is not a promise of end-to-end encryption.
Encryption at rest
Workspace channel credentials are encrypted at the application layer with AES-256-GCM using an environment-managed encryption key. API responses mask credential values.
Password security
Passwords are hashed with argon2id (memoryCost 19 MiB, timeCost 2, parallelism 1) — the strongest mainstream password hashing algorithm. Plaintext passwords are never logged or stored. New passwords are checked against the Have I Been Pwned k-anonymity API before acceptance.
API key design
API keys are generated with 32 bytes of cryptographic randomness (CSPRNG). Only a SHA-256 hash is stored — the plaintext key is shown exactly once at creation and is unrecoverable. Keys support fine-grained scopes, channel restrictions, IP allowlists, and expiry dates.
Session management
Sessions use iron-session v8 with a 256-bit encryption key. Session cookies are httpOnly, Secure, and SameSite=Lax. Sessions slide on activity with a 30-day maximum lifetime. Password reset invalidates all active sessions for that user immediately.
Multi-tenant isolation
Every database query on user-facing data is scoped to an Organisation ID resolved from the session or API key — never from request body parameters. Organisation boundaries are enforced at the middleware layer on every route.
Rate limiting
All authentication endpoints are rate-limited per IP using a Redis-backed sliding-window counter, independent of API rate limits. The API itself enforces per-organisation daily send limits with Redis counters that reset at midnight UTC — not rolling 24-hour windows that can be gamed.
Infrastructure
The API and email delivery service run on Senddio-managed EU servers rather than a third-party SMTP relay. Shared email traffic is split into isolated transactional and broadcast IP pools. Enterprise organisations can use their own dedicated sending IPs.
Suppression list
Active workspace suppressions block matching recipients before sending. Administrators should only remove a suppression after resolving its cause and confirming permission to send.
Audit logging
Audit events record workspace changes and acting-user context. Audit-log access is available on Pro and Enterprise; retention and access follow plan entitlements.
Webhook signatures
Every outbound webhook payload is signed with HMAC-SHA256 using a per-endpoint secret. The signature is sent in the Senddio-Signature header so your server can verify the payload has not been tampered with in transit.
Dependency management
A dependency lockfile records resolved package versions. Security maintenance includes reviewing dependency updates; this page does not promise a fixed patching deadline.
Found a vulnerability?
We take security reports seriously and respond within 48 hours. If you discover a potential vulnerability we ask that you give us a reasonable time to fix it before public disclosure.
- A clear description of the vulnerability and its potential impact
- Steps to reproduce, including any relevant URLs or request payloads
- Your contact details so we can keep you updated
- We will acknowledge your report within 48 hours
- We will keep you informed of our progress
- We will not take legal action against researchers acting in good faith
- We will credit you in our changelog if you wish
Please do not use public issue trackers or social media to report security vulnerabilities.