Security

What you must do on your side, and what we guarantee on ours. The full internal policy lives in our SECURITY.md — this page is the developer’s-eye summary.

Your keys

Store keys in environment variables or a secret manager — never in client bundles, never in git. Rotate on a schedule and immediately on any suspected leak. Test and live keys are cryptographically distinct; a test key can never deliver real mail.

Our guarantees

Keys are hashed at rest (we can show a prefix, never the secret). Every tenant query is scoped by organization and project at the data layer. Webhook payloads are HMAC-signed; verify them. Error responses carry request IDs, never stack traces or secrets. See the full posture on our security page.

Reporting issues

Found something? Write to support@calder.click with “security” in the subject. We triage the same day and will keep you posted through the fix.