Keys you can control
API keys are scoped to one project and to the permissions you choose, shown once, stored only as a hash, and revocable instantly. Repeated wrong guesses from one address are blocked.
Security you can check.
What we do today, where your data lives, and what we have not done yet.
In place today
YesAPI keys stored hashed, shown once
YesWebhooks signed, with replay protection
YesMessage bodies deleted after 30 days
YesAudit log of sensitive actions
What we do today.
Isolation between customers
Every request is tied to one project by its key. A key can’t read another project’s mail, and the same rule covers people in the dashboard. Automated tests check it.
Secrets stay secret
Webhook signing secrets are encrypted at rest with AES-256-GCM. Sign-in links are single-use and short-lived. Payment details never touch our servers: Stripe handles them.
Encrypted in transit
Everything goes over HTTPS with HSTS. Webhooks are delivered only to public HTTPS addresses, with private networks blocked.
Little content kept
Message bodies are deleted after 30 days, or sooner if you choose. Request logs hold no message content or recipients. Attachment files are deleted once handed to the mail provider, and webhook payloads never include message bodies.
An audit trail
Key, domain, member, spending and suppression changes are recorded with who and when, readable by your owners and admins.
Sign-in without passwords
No passwords to leak or reuse. Authenticator-app two-factor sign-in is available for every account.
Abuse controls
New accounts are reviewed before live sending, domains must be verified, and sending is paused automatically if bounce or complaint rates climb.
Where your data lives.
| Provider | What it does | For |
|---|---|---|
| Amazon Web Services | Sends the email (SES) and queues work. | Email delivery, queues, event notifications |
| Railway | Runs the API and the database. | API, database |
| Vercel | Hosts this website, the documentation, the dashboard and our DNS. | Website, dashboard, DNS |
| Stripe | Takes payments and sends invoices. | Billing |
| Spacemail | Hosts the support and security mailboxes. | Our own company email |
These are the companies that handle customer data on our behalf. We will update this list before adding one.
What we don’t have yet.
- A SOC 2 or ISO 27001 report. We have not been audited yet.
- A third-party penetration test report.
- A signed data processing agreement template, and a HIPAA business associate agreement.
- A published uptime commitment (SLA). Enterprise customers can agree one in a contract.
- Single sign-on.
If one of these is a requirement for you, tell us. It shapes what we build next, and Enterprise terms can cover some of them.
Found a problem?
Email security@sendsend.email. Please give us a reasonable time to fix it before sharing it, and don’t access other people’s data. We will reply and keep you updated.
For anything else, contact support@sendsend.email.