OPERATIONS / TRUST
Security and privacy
How mailbox access, secret storage, HTML isolation, webhook signing, and delivery controls fit together.
Loading documentation…
How mailbox access, secret storage, HTML isolation, webhook signing, and delivery controls fit together.
Loading documentation…
Shared mailbox content is available to workspace members. Private mailbox content requires an explicit mailbox grant. Administrative power over domains, routing, or billing does not implicitly grant access to a private mailbox’s messages or attachments.
Raw MIME and attachments are stored in private object storage rather than the application metadata database. Incoming HTML is sanitized and displayed in a restricted frame with remote resources blocked.
Downloads check the requesting identity, workspace, and mailbox access. Resource IDs are not treated as authorization.
API key secrets are stored as hashes and shown only when created. Keys can be scoped, expired, reviewed by last-used time, and revoked. Keep them in a server-side secret manager or environment variable.
.env or deployment secrets.mail:send only to workloads that send.Webhook signing secrets are encrypted at rest and shown once. Deliveries sign the timestamp and exact body with HMAC-SHA256. Consumers should verify the signature before parsing, enforce a timestamp tolerance, and deduplicate by delivery ID.
Startup Mail validates inbound provider signatures and configured topics, bounds message and attachment sizes, treats queue delivery as at least once, and suppresses recipients after hard bounces or complaints. Automated reputation controls can pause outgoing mail without removing access to incoming messages.