Data protection

This page states what the platform does with your data. Each statement maps to code or to a written operating procedure.

Encryption

In transit. TLS protects every hop. The browser talks to the console over TLS. The app verifies the database certificate. The app and the worker sign each request to Amazon SES, KMS and S3, so the AWS secret never travels.

SMTP. The relay accepts TLS 1.2 or later only. It refuses a login on a plain connection. It takes your API key as the password, so there is no second SMTP secret to store or rotate.

Secrets at rest. The platform encrypts DKIM private keys, webhook signing secrets and Slack alert URLs with AES-256-GCM before it stores them. AWS KMS wraps the data key.

Your own key. A client organization gets its own AWS KMS key. The platform encrypts the secrets and the stored message bodies of that organization under that key and under no other. AWS CloudTrail records each decrypt of that key with the key identifier. That record answers "who read the material of this tenant, and when" outside our own logs.

Key deletion. When you delete the organization, the platform schedules the key for deletion. After the 30-day window nobody can read anything that the key protected.

Internal organizations. Brands we own share one platform key.

What the platform stores, and for how long

Data	Where	Kept for
Message body (HTML, text, headers, attachments)	Object storage (S3), encrypted under the organization key	Body retention on Settings → Organization: 0 to 90 days. 0 keeps no content: the worker removes the body as soon as it sends the message. If that removal fails, the daily retention pass finishes it.
API request log for POST /emails	Database	Body retention. With body retention 0, HTML, text and template data are never written to the log, only their length.
Message metadata (addresses, subject, status, provider id) and events	Database	Event retention: 1 to 3650 days.
Contacts, suppressions, templates, API keys (hashed), audit log	Database	For the life of the organization. The platform does not trim the audit log.
DMARC aggregate reports	Database	13 months.
Inbound messages	Database and S3	Event retention.

The worker runs retention once a day. It removes anything past its window. It deletes the S3 object first, then the pointer.

Deletion

Only an admin can delete an organization (Settings → Organization → Danger zone). The delete removes the domains, API keys, messages, contacts, broadcasts, automations, webhooks and alert rules at once. The platform schedules the KMS key for deletion (30 days).

The bucket lifecycle rule expires any message body still in S3 within 90 days. Nobody can read those bodies once the key is gone. Database backups follow the point-in-time window of the database provider. SES identities and DNS records belong to you, and the delete does not change them.

Who can reach your data

Members of your organization, with the role you gave them (ADMIN, MEMBER, VIEWER). The audit log records every action in the console and the API.

Named platform operators, for support you asked for, an incident, or maintenance. The console has no impersonation feature. Before an operator opens a session against production data, a script writes an operator.access entry with a reason into your audit log. MFA protects production credentials. We review them each quarter.

Amazon SES delivers the mail. It holds a copy of each DKIM private key so it can sign.

Sub-processors. Amazon Web Services (us-east-1, with us-west-2 for failover) hosts SES, KMS and S3. Netlify hosts the console and the API. Prisma Postgres (US East) hosts the database, and Upstash hosts the queue. Cloudflare fronts the DNS of the platform. Stripe handles billing, and Google provides sign-in.

Limits, stated plainly

The platform must handle message bodies and recipient addresses in plaintext to render and send them. SES must hold the DKIM key to sign. Per-organization keys protect data at rest: a lost database copy, a lost bucket, a backup. They also make each decrypt of your material auditable.

They do not stop an operator with live production access from reading live data. Every email provider carries that same limit. If you need a key that we cannot use without your consent, ask about customer-owned keys. The per-organization key is the step before it.

Incidents

If we discover a security incident that affects your data, we tell the admins of the organization by e-mail without undue delay. Our target is 72 hours from discovery. We follow up with what happened, what it affected and what changed.