Security
How the platform protects your account, your list and your sending reputation.
Accounts and access
Passwords are stored as salted bcrypt hashes and are never recoverable in plain text — a reset issues a new one rather than revealing the old one. Sessions are cookie-based, signed, and invalidated on logout and on password change.
Accounts support multiple users with role-based permissions, so an agency or a team can give a contractor access to one area without handing over the whole account. API access uses per-account keys that can be rotated at any time.
Data in transit and at rest
Traffic to the application is served over TLS. Uploaded assets are stored outside the web root and served through the application, so a direct URL guess cannot walk your files.
Every write is scoped to the customer that owns the record — the application checks ownership on the object, not just on the URL, which is what stops the classic "change the id in the address bar" attack.
Sending security
Sending domains are verified with DKIM and SPF before a campaign can use them, and the exact DNS records to publish are shown in the application. Tracking links can run on your own domain rather than a shared one, so your links inherit your reputation instead of somebody else's.
Warmup schedules ramp new domains and IPs gradually. Bounce and feedback-loop handlers process replies automatically and suppress addresses that hard-bounce or complain.
Abuse prevention and audit
New accounts and campaigns can be held for review, sending is rate-limited per server and per plan, and a blacklist blocks addresses and domains you never want contacted.
Every significant action in the application is written to an activity log with the user, the time and the affected record, so an account holder can reconstruct what happened.
Backups and portability
Backups depend on how this installation is hosted; where we host it, database backups are taken daily and retained on a rolling window, and restores are tested rather than assumed.
Because you can connect your own sending provider and export your full list at any time, you are never locked into our copy of your data as the only copy.
Reporting a vulnerability
If you believe you have found a vulnerability, please report it through the contact page before disclosing it publicly. Include enough detail to reproduce it. We will confirm receipt, keep you updated while it is being fixed, and credit you if you would like to be credited.
Please do not run automated scanners, denial-of-service tests, or tests that touch other customers' data.