🔒

Security at MailPulse

We take security seriously. Your data, credentials, and privacy are our top priorities.

Encryption at Rest

All sensitive data, including AWS credentials, is encrypted using AES-256. We never store plaintext secrets.

Encryption in Transit

All API communication uses TLS 1.3. HTTP traffic is automatically redirected to HTTPS.

Access Monitoring

We monitor all access to our infrastructure. Suspicious activity triggers immediate alerts.

Security Headers

Every response includes CSP, X-Frame-Options, XSS Protection, and other security headers.

Rate Limiting

API endpoints are rate-limited to prevent abuse. Limits are generous for legitimate use.

Regular Audits

We perform regular security audits and dependency updates to maintain a strong security posture.

How we handle AWS credentials

Your AWS credentials are the most sensitive data we store. Here's how we protect them:

Encrypted at rest: AES-256 encryption with key rotation
Never logged: Credentials are never written to logs
Minimal access: We only use SES-specific API permissions
Isolated storage: Credentials stored separately from other data
Secure transmission: Only sent over TLS 1.3

IAM Policy (minimal permissions)

{
  "Effect": "Allow",
  "Action": [
    "ses:SendEmail",
    "ses:SendRawEmail",
    "ses:GetSendQuota",
    "ses:GetSendStatistics",
    "ses:ListIdentities"
  ],
  "Resource": "*"
}

Data handling

What we collect, how we use it, and how long we keep it.

Data Type	Purpose	Retention
AWS Credentials	SES API access for monitoring and sending	Until you delete them
Email Metadata	Delivery tracking, bounce/complaint monitoring	Plan-based (7d / 90d / 1y)
Webhook Logs	Debugging, audit trail	30 days
Alert History	Alert management, resolution tracking	90 days
Account Info	Authentication, billing	Until account deletion
Usage Analytics	Product improvement, billing	12 months (anonymized)

Infrastructure security

Built on secure foundations.

Hosting

Landing page: Vercel (CDN, DDoS protection)
Backend: Docker on isolated VPS
Database: PostgreSQL with encrypted connections

Network

Ports bound to 127.0.0.1 (no external access)
Cloudflare WAF and DDoS protection
Firewall rules on VPS

Application

JWT-based authentication
bcrypt password hashing (4.0.1)
Input validation on all endpoints
CORS properly configured

Monitoring

Uptime monitoring
Error tracking
Access logs
Security alert notifications

Incident response

If a security incident occurs, we follow a structured response plan:

Detect: Automated monitoring alerts us to anomalies
Contain: Isolate affected systems immediately
Investigate: Determine scope and impact
Notify: Inform affected users within 72 hours
Remediate: Fix the issue and prevent recurrence
Report: Publish post-mortem for transparency

Report a vulnerability

Found a security issue? We appreciate responsible disclosure.

Email: [email protected]

PGP key available on request

Compliance

We're building toward full compliance with industry standards.

✓ Implemented

GDPR Ready

Data export, deletion, and consent management. Full compliance with EU data protection regulations.

✓ Implemented

Data Encryption

AES-256 at rest, TLS 1.3 in transit. Industry-standard encryption for all sensitive data.

In Progress

SOC 2 Type II

Working toward SOC 2 certification. Expected completion: Q1 2027.

Questions about security?

We're transparent about our practices. Reach out anytime.