Security

Your email holds your customers' data, so we build Inboxjot to keep it safe.

How We Protect Your Data

• All traffic is encrypted, and our database and file storage encrypt data at rest.
• Secrets, such as webhook signing secrets, are encrypted before we store them.
• API keys and sign-in codes are stored only as hashes.
• Our internal systems are not exposed to the internet.
• We keep backups for a limited time with a separate provider.

How We Protect Your Account

• Sign in with an email code, Google or GitHub, so there is no password to leak.
• See your active sessions and sign out of any of them.
• Workspace roles limit what each member can see and change.
• Revoke any API key at any time.

How We Protect Your Sending

• You can send only from domains you verify.
• Bounces, complaints and unsubscribes are suppressed automatically.
• Sending pauses when bounce or complaint rates stay too high.

Report a Vulnerability

If you find a security issue, write to us at security@inboxjot.com. Please give us time to fix it before you share it, and do not access other people's data while you test.