Effective August 6, 2026
Security at eimailar
Layered controls protect accounts, tenant data, sending authority, and email reputation.
Identity and access
Passwords use Argon2id. Sessions and one-time account credentials are stored as hashes, expire, and can be revoked. New accounts require email verification. Sensitive workspace actions use role-based authorization and produce bounded audit records.
Tenant and sending controls
Tenant-owned records are scoped by workspace at the application boundary. New workspaces start restricted. Sending requires approved tenant state, an activated and provisioned domain, stream alignment, and provider-level controls. Marketing delivery also requires active consent and suppression checks.
Delivery safety
Queue workers recheck policy immediately before provider handoff. Delivery uses idempotency, capped retries, circuit breakers, per-stream limits, and reconciliation for ambiguous provider acceptance. Complaints and hard bounces create suppressions.
Secrets and content
API keys, sessions, and account action credentials are not stored in raw form. DKIM private keys are encrypted at rest. Logs and audit records are designed to exclude credentials and email bodies. Public links use purpose-bound signed tokens.
Report a vulnerability
Email operator@eimailar.com with a clear description, affected URL, reproduction steps, and impact. Do not access other users' data, disrupt delivery, or publicly disclose an unresolved issue. For spam or harmful mail, use the abuse form.