Security
Last updated
The emails your applications send are often the most sensitive thing they touch. Here is, measure by measure, how we protect them. This document is also available in French. In case of discrepancy, the French version prevails.
1. Hosting and encryption
- Infrastructure and captured emails hosted in France (Paris).
- Encryption in transit: TLS for SMTP, the API and the app.
- Encryption at rest of the database and attachment storage.
- Webhook secrets encrypted in the database; passwords hashed with bcrypt.
2. Email isolation
- No captured email is ever delivered to its recipient.
- SMTP credentials per project: a misconfigured environment cannot write into another customer's inbox.
- Spam analysis runs on our own servers; email content is never sent to an AI service.
- Remote images loaded through a proxy, so the reader's IP address is not exposed.
3. Access and accounts
- Two-factor authentication (TOTP) with recovery codes; Google and GitHub sign-in.
- Email alert on every sign-in from a new device.
- Roles per organization and access per project; activity log on the plans that include it.
- API tokens scoped to one organization and, if needed, to specific projects; revocable.
- Rate limiting on sign-in, the API, shares and the sandbox.
5. Operations
- Staff access to customer data limited to what is strictly needed (requested support, security).
- Error tracking configured not to send personal data.
- Retention periods set for each category of data; erasure on request.
- Encrypted backups stored in France, kept 180 days.
6. Reporting a vulnerability
Write to security@mailclutch.com with steps to reproduce. We reply within 72 business hours and take no action against research done in good faith, without accessing others' data or disrupting the Service. For contractual commitments, see the DPA.