Security

All customer data is stored within the European Union — database, API servers, queue, and email delivery all run on EU infrastructure we operate ourselves. We do not replicate customer data outside the EU. See our Privacy Policy for the specific sub-processors and their regions.

In transit — all traffic to our API and dashboard is served over HTTPS (TLS). We send HTTP Strict Transport Security (HSTS) so browsers refuse to connect over plain HTTP, along with hardening headers (X-Content-Type-Options, X-Frame-Options, a strict Referrer-Policy) on every response.

At rest — our database and queue encrypt data at rest at the storage layer. Sensitive sending material, such as the DKIM private keys used to sign your mail, is additionally encrypted by us with AES-256-GCM — under a key derived uniquely for each stored secret — before it is written to the database, so it is never stored in plaintext.

• Account passwords are stored only as salted hashes — never in plaintext.
• Two-factor authentication (TOTP, via any authenticator app) is available and can be enabled from your account settings, with single-use backup codes for recovery.
• API keys are shown once at creation and stored only as hashes; we cannot recover a key, only verify and revoke it.
• Email verification is required, and password reset uses single-use, expiring tokens.
• Dashboard sessions use a single HTTP-only cookie. We do not use tracking or advertising cookies.
• Revoke or rotate an API key at any time from your dashboard; revocation is immediate.

Every domain you send from is authenticated with DKIM (we generate and store the signing key encrypted) and SPF, so receiving servers can verify your mail is genuinely from you.

We run our own sending infrastructure inside the EU and actively protect shared deliverability: new accounts send under a progressive trust ramp, we monitor bounce and complaint rates per account and platform-wide, and an automatic kill-switch halts sending before a problem can spread. Senders who generate excessive bounces or complaints are suspended.

We apply per-account rate limits on the API and stricter IP-based limits on public endpoints to resist brute-force and enumeration. Sending volume is monitored continuously: accounts ramp into higher limits as they build a clean track record, and automated controls suspend a sender — and can pause the platform — if bounce or complaint rates cross safe thresholds. This protects both individual accounts and the shared sending reputation.

Inbound notifications we consume (for example, delivery and reputation events from our email provider) are signature-verified and pinned to the expected source before we act on them, so a forged request cannot change your account state. Outbound webhooks we send to you are delivered over HTTPS.

Polar is the seller of record for all eusend purchases and handles payment end to end. Card details are entered directly with Polar and never touch our servers — we store only a Polar customer and subscription reference. Because we never receive, transmit or store cardholder data, card security is Polar's responsibility rather than ours.

Email logs and delivery events are retained for 30 days on every plan (90 on Scale) and then deleted automatically, along with the rendered message body and any attachments that email carried. Content you save — audiences, templates, and broadcasts — is kept until you delete it. When you delete your account, your data is removed and the associated sending identity is torn down so nothing keeps sending or lingers on our infrastructure. Full details are in our Privacy Policy.

We welcome reports from security researchers and will work with you in good faith to verify and fix valid issues. If you believe you've found a vulnerability, email security@eusend.dev with enough detail to reproduce it. Please:

• Give us a reasonable time to investigate and remediate before any public disclosure.
• Avoid privacy violations, data destruction, service degradation, and accessing or modifying data that isn't yours — use only test accounts you control.
• Do not run automated scanning that disrupts the service or other customers.

If you make a good-faith effort to comply with the above, we will not pursue or support legal action against you for your research. We aim to acknowledge reports within a few business days and will keep you updated as we work toward a fix.

Security issues: security@eusend.dev. For privacy and data requests, see our Privacy Policy.