Security

What we do, stated plainly — including what we don't claim.

Transport

Everything is encrypted in transit: the website and API are HTTPS-only with HSTS, and the SMTP relay requires STARTTLS before it will accept credentials — plaintext authentication is refused at the protocol level.

Credentials

Account passwords are stored as salted PBKDF2 hashes. API keys are shown once at creation and stored only as SHA-256 hashes — we cannot read your key back, and neither can anyone who obtains our database. Keys are revocable instantly from the dashboard. Password reset links are single-use, hashed at rest, and expire after 60 minutes.

Webhooks

Every webhook delivery is signed with a per-endpoint secret (HMAC-SHA256 over a timestamped payload) so your receiver can verify authenticity and reject replays.

Infrastructure

Email is delivered through Amazon SES; the application runs on Railway with a managed Postgres database, and the website on Vercel. Access to production systems is limited to the operator. Sending domains are authenticated with DKIM and SPF, and each account's data is scoped by account at the application layer.

Data minimization

Email logs are retained only for your plan's window (7/30/90 days) and then permanently deleted — old mail isn't sitting in our database indefinitely. Details in the Privacy Policy.

What we don't claim

Sendibl does not currently hold SOC 2 or ISO 27001 certification. If your compliance program requires audited attestations today, we may not be the right fit yet — we'd rather say that here than have you discover it in a vendor review.

Reporting a vulnerability

Found something? Email support@sendibl.com with details. We commit to acknowledging reports within 48 hours and fixing verified issues promptly. Good-faith research against your own account is welcome; please don't access other customers' data or disrupt the service.