Platform Security
Mailofly is architected from the ground up with defense-in-depth security to protect your sender reputation and subscriber data.Encryption Standards
- In Transit: All API traffic, dashboard sessions, and SMTP connections require modern TLS (TLS 1.2 or TLS 1.3) with strong cipher suites. Unencrypted plaintext connections are rejected.
- At Rest: Database tables, email logs, and OAuth tokens are encrypted using AES-256 with keys managed in hardware security modules (HSM).
API Key Security
- Prefixing: All live keys use standard
mf_live_prefixes for easy identification in secret scanners. - Granular Scopes: Generate keys restricted solely to sending mail or read-only access for analytics.
- Secret Detection: Mailofly actively scans GitHub public repositories for leaked API keys. If your key is detected publicly, it is automatically revoked to prevent abuse.
Infrastructure Hardening
- Multi-tenant data isolation with strict row-level security (RLS).
- Automatic rate-limiting and DDoS mitigation through Cloudflare.
- Regular third-party penetration testing and vulnerability assessments.