Security
Paranoia, documented.
We handle credentials, email addresses, and billing data, so we treat all of it as sensitive by default. Here's exactly what that means in practice — and where we are on formal certifications.
API keys hashed at rest
SHA-256 with constant-time comparison. We can show you a prefix; we can never show you the key.
Tenant isolation at the data layer
Every query scoped by organization and project — not just the route middleware.
Signed webhooks, verified inbound
HMAC on everything we send; signature checks on everything we accept.
Secrets stay server-side
Nothing sensitive reaches the browser, the logs, or an error response. Ever.
Predictable errors
Request IDs on every response; stack traces on none of them.
Dependency hygiene
Pinned lockfile, scanned in CI, no surprise additions.
Certifications, honestly
We’d rather show you a roadmap than a badge we haven’t earned.
Get started
Go get your first delivery.
Not your first signup form, not your first dashboard tour — your first email, landing in an inbox, with the webhook to prove it. Test keys are free and can’t hurt anything. The only thing standing between you and that little delivered tag is one POST request.