Security

What we do to keep your keys, your mail and your data safe, in plain terms. This page covers what you can rely on as a customer; it is not a description of our internal infrastructure.

API keys

• Keys are shown once, when you create them, and stored only as a SHA-256 hash. We cannot read a key back, and neither can anyone who reads our database.
• Live and test keys are separate. A test key (av_test_) can never deliver mail, so a test key in a CI log is not a sending credential.
• Revoke a key from the dashboard and it stops working on the next request. The dashboard shows when each key was last used.
• A key carries scopes; a send-only key cannot read the log or change the account. See Scopes.
• Every key is rate limited (between 10 and 50 requests a second per key depending on plan, see Plans and limits), and each account has a monthly sending allowance, so a leaked key cannot send unbounded volume.

Sending from your domain

• A domain sends only after DKIM verification proves control of its DNS. Each domain can be verified on one account only.
• The sandbox sender delivers only to your own verified address and the simulator recipients, so a fresh account cannot send to strangers before verifying a domain.
• Addresses that hard-bounce or complain are added to your suppression list automatically, and further sends to them are refused until you remove the entry.

Webhook signing

Every delivery to your endpoint carries an Avelto-Signature header: t=<unix seconds>,v1=<hex>, where v1 is HMAC-SHA256 over "<t>.<raw body>" with the endpoint's secret. The secret is shown once when you create the endpoint.

Verify every request before acting on it:

1. Compute the HMAC over the exact raw body, not a re-serialised object.
2. Compare it to v1 in constant time.
3. Reject requests whose t is more than five minutes from now, which stops replays.

The Node SDK's verifyWebhookSignature(secret, rawBody, header) does all three. See Webhooks and Webhook events.

Endpoints must use HTTPS in production, and we never follow redirects from your endpoint.

Provider events

Delivery, bounce and complaint events reach us through Amazon SNS. We accept a notification only when its signature verifies against Amazon's signing certificate and it comes from the topic we own, and each message is accepted once. No one can inject a fake delivery or bounce into your log by posting to our endpoint.

Where your data lives

Your account data, email records and events are stored and processed in the EU. Email is sent through Amazon SES in the EU (Stockholm) region. This is the same for every plan; Enterprise contracts state it in writing.

Retention

Email bodies are kept for the retention period of your plan (see Pricing). After that the record and its events remain, with any quoted content removed, so ids and statuses keep resolving. Suppression lists and domain settings are kept until you remove them or delete the account.

Deleting your account removes every email, domain, key, webhook endpoint and suppression, and releases your domains from our sending provider.

Sessions

Dashboard sign-in uses single-use links that expire after 15 minutes. Sessions last 30 days and can be revoked on every device at once from Settings.

Reporting a vulnerability

Found something? Email security@avelto.dev with the details and steps to reproduce. We reply within two working days, fix confirmed issues before public disclosure, and credit reporters who want it. Please do not test against other customers' accounts or send unsolicited email through the service.