Security posture, plainly.
The honest baseline.
We say what’s done and what’s not.
- TLS 1.3 in transit
- Encrypted at rest
- DPA on request
Compliance posture
Today: GDPR-aligned baseline (Article 28 sub-processor disclosure published, DPAs available on request, Article 17 erasure self-serve from Settings or through support).
Encryption + data handling
Customer-managed keys (BYOK) are on the roadmap for procurement-gated customers — not shipped today.
Data in transit
Data in transit: TLS 1.3 across every public surface (api.mails.ai, the dashboard, the marketing site).
Data at rest
Data at rest: the primary database is Neon (managed Postgres), encrypted at the infrastructure layer; message content, raw received mail included, is stored there.
Keys and tokens
API keys and magic-link tokens are SHA-256 hashed at rest — even we cannot recover a lost key or token, you mint a new one.
Sub-processors
Each vendor has a specific purpose. Purposes, data categories, regions and added-dates at /sub-processors. Subscribe to /changelog for updates.
Security controls
Where one customer's data ends and the next begins, what every call leaves behind, and what happens to your data when you go.
Tenant isolation
- Workspace-level data isolation
- Rows keyed to their workspace
- No cross-tenant queries
+ 4 more
- Separate reputation scope
- Rate limits per API key
- Route-layer workspace checks
- Isolation stress suite
Audit + observability
- Audit log of every API call
- Caller IP and key prefix logged
- In-app audit-log retrieval
+ 1 more
- Planned: Long-term archival to S3
Customer data exports + deletion
- Self-serve erasure from Settings
- Self-serve deletion receipts
- Access requests within 30 days
+ 2 more
- Self-serve CSV export
- Planned: Customer-managed keys (BYOK)
Abuse + reputation
- Prompt-injection scanning
- Classifier auto-throttling
- Per-agent reputation graph
+ 1 more
- Complaint auto-suspend at 0.3%
Vendors + incidents
- Per-vendor scope limitation
- Customer-data minimization
- Public notice of vendor changes
+ 2 more
- Notice of any confirmed breach
- 90-day disclosure coordination
Vulnerability disclosure
Report security issues to support@mails.ai. No bug-bounty program and no payment for reports. The threat model that scopes valid reports is at /security.
Runs on infrastructure from our sub-processors
- Cloudflare
- Vercel
- Neon
- Hetzner
- OVH
- Stripe
Frequently asked questions
Is my data encrypted?
Yes. TLS 1.3 protects every public surface in transit. At rest, the primary database (Neon, managed Postgres) is encrypted at the infrastructure layer and holds message content, raw received mail included, and API keys and magic-link tokens are stored only as SHA-256 hashes.
Bring-your-own-encryption-key (BYOK) is roadmap, not shipped — flag it in your DPA request if you need it for a procurement decision.
Do you have SOC 2, HIPAA or ISO 27001?
No. We do not hold SOC 2 or any other certification today. Where each one stands:
- SOC 2 and ISO 27001: not held.
- HIPAA: not in scope; no BAA is offered.
How do I get a DPA, or ask a security question?
How is one customer’s data kept apart from another’s?
- Per-customer data isolation at the workspace_id boundary.
- Every row carries its workspace_id; no cross-tenant queries.
- Per-agent reputation lives in a separate scope from per-account billing data; an inadvertent reputation query cannot leak billing or message content.
- Rate limits scoped per-key.
- The boundary is enforced at the route layer (every authenticated route runs through requireApiKey and a workspace check) and verified by a dedicated workspace-isolation stress suite that ships with the smoke tests.
What does every API call leave behind?
- Every API call writes an audit_log row with category (auth, billing, sends, agents, etc.), action, target resource, API-key prefix, IP, user-agent, and timestamp.
- Audit-log retrieval in the dashboard and via /api/v1/logs (read-only, scoped to the requesting workspace).
- Long-term archival to S3 (90-day hot / 1-year cold) is on the Phase 2 roadmap.
Can I delete or export my data myself?
Deletion, yes: in the dashboard, Settings then Danger zone deletes a workspace or your whole account at once, and you get a deletion receipt. Export is self-serve too.
- GDPR data-subject rights are first-class in design.
- Today: erasure is self-serve from Settings (a workspace or your whole account, with a deletion receipt), and access requests are handled via support@mails.ai within 30 days.
- Self-serve export from the dashboard: the message, event and audit-log lists download as CSV.
How are EU and UK transfers handled?
Do AI sub-processors receive my email content?
Where can I find the list of sub-processors?
Cloudflare (sends and receives your mail, with its full content), Vercel (hosts the dashboard and the API), Neon (managed Postgres primary database, encrypted at rest), OpenAI (model inference for the classifier), OVH (our own mail servers), Hetzner (this website, our own analytics server and our own error tracker) and Stripe (billing + payment processing only — no Identity / KYC product), with PostHog, Sentry, Gleap, Google Workspace, Better Stack, Google Analytics, GrainQL, jsDelivr and YouTube for analytics, error reports, support and this site.
Each one’s purpose, data, region where a source names one, and the date it was added are at /sub-processors. Subscribe to /changelog for updates. How sends and inbounds flow through them is on the architecture page.
Do you pay for vulnerability reports?
“Replies come back as events with an injection score already on them. We deleted a whole layer of parsing code the week we switched, and we gate on the quarantine flag, so our agent never sees the ones that look like attacks.”
“Moving our agent onto our own domain was a few DNS records at the registrar. No nameserver move, and our existing mail kept working. Replies to the agent still come back to its inbox, threaded with the message they answer.”
“The 422 on cold outreach is the feature I didn’t know I wanted. An agent can’t talk itself into emailing strangers.”
“Our tests send to the test address and wait for the real reply, so the whole loop is covered before a customer ever writes in. It answers in about a second, which keeps the suite fast.”
“Adding the MCP server was one JSON block. Claude Code could send and read its own inbox a minute later.”
“A reputation score per agent tells us exactly which one needs attention, instead of one number for the whole account. It comes from each agent’s own replies, bounces and complaints, and we read it from the API.”
“Sends and replies have separate allowances, so a busy inbox never eats our sending quota. Pricing was the easy part.”
“Half our agents are LangGraph in Python and half are Node. Both SDKs make the same calls, so the team doesn’t have to think about it.”
“Signed webhooks, retries with backoff and an event id to dedupe on. The boring plumbing, done properly.”
“We signed up, made a key and sent our first message without talking to anyone, and the free tier never asked for a card. That’s how infrastructure should feel.”