Security is an architectural requirement, not a later add-on. The practices below are what the product actually does. We maintain SOC 2-aligned practices with documented controls and audit readiness. We are not SOC 2 certified. We do not claim guaranteed security, full compliance, or that the system is unhackable.
Isolation
Every resource belongs to a project under an organization. API keys and dashboard sessions resolve that project; queries are scoped to it. Sending-access keys can send and read their project; they cannot mint keys or manage domains.
Authentication
- Dashboard sessions: HS256 JWT in an httpOnly Secure SameSite=Lax cookie, revoked by bumping tokenVersion.
- API keys: shown once, stored hashed, per-key rate limits.
- God Mode impersonation is re-authorized on every request.
- Customer SSO and customer 2FA are not shipped. Operator MFA is on the follow-up list.
Encryption
TLS in transit at the edge. DKIM private keys and connected-account OAuth tokens are encrypted at rest with AES-256-GCM when the instance key is set. Password hashes are scrypt. Email bodies in Postgres are not field-encrypted.
Sending controls
- From domain must be a verified sending domain of that project, a connected mailbox, or a platform-hosted address the project owns.
- Suppression is checked before enqueue, case-normalized.
- Platform-hosted From requires a verified org-owner email.
- Webhook URLs are HTTPS-only and refused if DNS resolves to private, loopback, or metadata ranges. Redirects are not followed.
- Attachment path is rejected (no server-side fetch).
Abuse
Signup, login, and password-reset are rate-limited per IP and per email. Plan send caps are hard stops. Shared inbox domains have a platform kill switch. We do not currently publish a bug-bounty program.
Operations
Process liveness is GET /livez. Readiness (Postgres + Redis) is GET /readyz, also summarized on Status. Application mail is sent from a mail server we operate, not a third-party reseller.
Report a vulnerability
Email hello@usermails.com with enough detail to reproduce. Do not test against customer data or send live mail to third parties as a proof.