Security

Paranoia, documented.

We handle credentials, email addresses, and billing data, so we treat all of it as sensitive by default. Here's exactly what that means in practice — and where we are on formal certifications.

01

API keys hashed at rest

SHA-256 with constant-time comparison. We can show you a prefix; we can never show you the key.

02

Tenant isolation at the data layer

Every query scoped by organization and project — not just the route middleware.

03

Signed webhooks, verified inbound

HMAC on everything we send; signature checks on everything we accept.

04

Secrets stay server-side

Nothing sensitive reaches the browser, the logs, or an error response. Ever.

05

Predictable errors

Request IDs on every response; stack traces on none of them.

06

Dependency hygiene

Pinned lockfile, scanned in CI, no surprise additions.

Certifications, honestly

SOC 2 — not yet certified. Controls designed with it in mind; audit scheduled before enterprise launch.roadmap
GDPR — data-minimization and deletion workflows built in; formal DPA available at launch.roadmap
Transport — encrypted everywhere, strict security headers on all surfaces.live

We’d rather show you a roadmap than a badge we haven’t earned.

Get started

Go get your first delivery.

Not your first signup form, not your first dashboard tour — your first email, landing in an inbox, with the webhook to prove it. Test keys are free and can’t hurt anything. The only thing standing between you and that little delivered tag is one POST request.