Security

Security, described plainly

What we do today, without badges we have not earned. We do not claim SOC 2 or ISO 27001 certification. If you need a security questionnaire answered, write to us.

Infrastructure

Email is delivered by Amazon SES in AWS eu-central-1 (Frankfurt). The application, workers and database run on Railway in its EU region (Amsterdam, Netherlands). Each team sends through its own SES tenant, so one customer's reputation problems don't affect others. SpacePost uses its own SES configuration sets and a dedicated IAM user restricted to SpacePost's SES, SQS and SNS resources.

Encryption in transit

The API, dashboard and SMTP relay require TLS. Plain HTTP requests are redirected or refused, and the SMTP relay (port 25976) requires STARTTLS before authentication.

Encryption at rest

Our database volumes and backups are encrypted at rest by the hosting provider, and message data stored with Amazon SES is encrypted by AWS.

API keys

Keys (sp_live_...) are shown exactly once when created. We store only a SHA-256 hash, so we cannot show or recover a key later. Keys can be limited to sending only and to a single domain, and can be revoked instantly.

Webhook signing

Every webhook is signed with a per-endpoint secret using the Standard Webhooks scheme (webhook-id, webhook-timestamp, webhook-signature), so you can reject forged and replayed requests.

Access control

All data is scoped to a team and checked on every request. Dashboard sign-in supports email and password, magic links and GitHub. Our own staff access to production data is limited to what is needed for support and abuse handling.

Abuse controls

New teams are sandboxed to 100 emails a day for 7 days. Teams are paused automatically on high bounce or complaint rates, and every recipient is checked against your suppression list before sending.

Data retention

Email logs are kept for 30 days on Free, 30 on Pro and 60 on Scale, then purged by a scheduled job. Suppression entries and account data are kept while your account is active. See the Privacy Policy for deletion and export.

Sub-processors

The third parties that process customer data on our behalf are listed publicly, with purpose and location.

View sub-processors

Responsible disclosure

Found a vulnerability? Email security@spacepost.dev with steps to reproduce.

We acknowledge reports within three working days and keep you updated until it is fixed.
Please do not access other customers' data, degrade the service, send spam through our infrastructure, or publish details before we have fixed the issue.
We will not pursue legal action against good-faith research that follows these rules. We do not run a paid bounty programme yet.

Service incidents: status page.