What we protect,
and how.

Encryption and isolation.

Data is encrypted in transit and at rest. The two things you hand over that would hurt most — mailbox access and your domain's signing keys — carry their own encryption on top of that. The rest of this section is about making sure one workspace can never read another's.

• In transit and at restBoth
  Data is encrypted in transit and at rest. We don't publish algorithm or protocol versions here — they change, and a version string isn't something you can verify from outside.
• Tokens and signing keysAuthenticated encryption
  Mailbox access tokens and DKIM private keys are encrypted at rest with authenticated encryption, so a database copy on its own yields nothing usable.
• Workspace isolationFiltered on every query
  Every workspace-scoped record carries the workspace it belongs to, and every query filters on it.
• Audit logAppend-only
  Sensitive actions are written to an append-only log with a verifiable chain, so a copy of it can be checked rather than merely produced.
• Where it livesUnited States
  Data is hosted in the United States.

Accounts and permissions.

Five roles, enforced on the server rather than by hiding buttons. The one thing we want you to read twice is the first row: two-factor authentication is available, and it is not enforced.

• Two-factorAvailable, not enforced
  Two-factor authentication is available and strongly recommended. It is not currently enforced — we'd rather say that than imply otherwise.
• Single sign-onGoogle · Microsoft
  Sign in with Google or Microsoft instead of a password.
• RolesFive, server-side
  Owner, admin, sender, editor, viewer. Permissions are workspace-scoped and checked on the server for every request, not just reflected in the interface.
• SessionsRevocable
  Sessions can be revoked. A logout invalidates the refresh tokens already issued, rather than only clearing the browser.
• VerificationRequired at signup
  Email verification is required at signup, and sending is gated on it.

Compliance built into the send path.

Compliance that lives in a policy document gets skipped under deadline. These are checks the sender runs, on every send, whether or not anyone remembered them.

• Two streamsSeparate scope
  Marketing and app-triggered sending are separated, with independent suppression scope — so a marketing opt-out never silently kills a password reset.
• Do-not-send listOnly broadens
  Keyed on the email address rather than the contact record, so a one-off send to a raw address is covered too. Its scope only ever broadens.
• UnsubscribeRFC 8058
  One-click unsubscribe to RFC 8058 on every marketing send.
• Opt-out keywordsNot only English
  Honoured across channels — including Arabic and Urdu stop words on SMS and WhatsApp, not only English. A recipient has opted out whatever language they said it in.
• Bounces and complaintsAttributed per sender
  Ingested from the sending provider with verified signatures and attributed to the workspace that sent them, so a rising complaint rate throttles that sender rather than everyone.
• Unverified domainsBlocked
  Sending from an unverified domain is blocked, not warned about.
• New domainsVolume-limited
  A new domain is volume-limited until it has earned more, so a cold domain can't blast a full list on day one.

Evidence you can produce.

A consent-evidence export that stays available independently of the platform — the timestamped opt-in and opt-out trail, the suppression history that proves an opt-out was honoured, the audit log with its verifiable chain, and the contacts those records refer to. You can prove consent even if your account is suspended or on hold.

Being unable to produce a consent record looks identical to not having one. That is why availability of the evidence is part of the posture rather than an ops nicety.

And a public data-subject request intake, so your recipients can exercise their rights without routing through your support inbox. An opt-out submitted there is honoured immediately; access and erasure requests are forwarded to you, the controller.

See the request form your recipients use →

Not yet in place.

We'd rather you read this here than discover it in a questionnaire. When one of these changes, it moves out of this section rather than quietly disappearing.