Security and privacy

Mailbox privacy

Shared mailbox content is available to workspace members. Private mailbox content requires an explicit mailbox grant. Administrative power over domains, routing, or billing does not implicitly grant access to a private mailbox’s messages or attachments.

Message content

Raw MIME and attachments are stored in private object storage rather than the application metadata database. Incoming HTML is sanitized and displayed in a restricted frame with remote resources blocked.

Downloads check the requesting identity, workspace, and mailbox access. Resource IDs are not treated as authorization.

API keys

API key secrets are stored as hashes and shown only when created. Keys can be scoped, expired, reviewed by last-used time, and revoked. Keep them in a server-side secret manager or environment variable.

• Create a separate key per service or agent.
• Never put a key in client-side JavaScript.
• Do not commit .env or deployment secrets.
• Rotate a key immediately if it may have leaked.
• Grant mail:send only to workloads that send.

Webhook secrets

Webhook signing secrets are encrypted at rest and shown once. Deliveries sign the timestamp and exact body with HMAC-SHA256. Consumers should verify the signature before parsing, enforce a timestamp tolerance, and deduplicate by delivery ID.

Delivery safety

Startup Mail validates inbound provider signatures and configured topics, bounds message and attachment sizes, treats queue delivery as at least once, and suppresses recipients after hard bounces or complaints. Automated reputation controls can pause outgoing mail without removing access to incoming messages.