Controls, not assurances.
This page lists mechanisms that exist in the product, and says plainly where a control is a plan-level commitment rather than code. If something below is not precise enough for your review, ask — we would rather answer than have you infer.
- API keys
- Bearer tokens, scoped to a whole workspace or to a single domain, with a last-used timestamp so stale keys are visible.
- Rate limiting
- 60 requests per minute and 1,000 per hour per key, returned as a readable 429 rather than a silent drop.
- Idempotency
- An Idempotency-Key header makes a send replay-safe for 24 hours, so a retry storm cannot duplicate mail.
- Sessions
- Every active session is listed with its IP and user agent, and can be revoked individually.
- Roles
- Workspace owners and members, with teammate management scoped per workspace.
- Domain verification
- Mail only leaves for domains you have proven you control, via generated DKIM, SPF, and DMARC records.
- DKIM signing
- Per-domain keys, selector `mail`, generated on our side and published by you in DNS.
- Region control
- Each domain sends from the AWS region you choose, so data residency is a setting rather than a support ticket.
- Reputation enforcement
- Reputation is scored per domain and per workspace; a workspace that crosses the line is disabled automatically and its queued mail fails loudly.
- Suppression lists
- Held per stream, so a transactional unsubscribe does not silently kill a broadcast, or the reverse.
- Signed payloads
- Every endpoint gets its own HMAC secret; verify the signature over the raw body before trusting anything in it.
- Delivery log
- Attempts, response codes, and response bodies are stored per delivery, so a failing endpoint is diagnosable rather than mysterious.
- Raw payloads
- We keep the provider's original event payload alongside our normalised version. Normalisation is never the only record.
- Retention
- Event retention runs from 30 days to 12 months depending on plan, and is configurable on Dedicated.
- Transport
- TLS everywhere: HTTPS for the API, STARTTLS on the SMTP relay.
HIPAA and the honest version.
We operate HIPAA-compliant medical sending workloads today. Regulated mail belongs on isolated infrastructure, so a Business Associate Agreement is offered on the Dedicated plan rather than on shared plans — a BAA over a shared pool would be a document rather than a control.
We do not ask for, want, or knowingly store protected health information in message content we retain. If your use case requires content retention limits, say so before you start and we will configure it rather than discover it later.
Ask us firstBAA terms, retention limits, and residency are all settled in writing before you send.
Email security@getoutsend.com with enough detail to reproduce the issue. We will acknowledge within two business days and tell you what we found, including if we disagree that it is a vulnerability.
Please do not test against other people's workspaces or send mail you are not authorised to send. Because the core is open source, the easiest and safest place to probe is an instance you run yourself.
Fixes that affect self-hosted operators are announced in the changelog with the affected versions named.
Bring your security review.
We would rather answer a hard questionnaire than have you assume the generous interpretation.
Open core · never venture-backed · operated by Martin Business Consultants