> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mailofly.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Mailofly platform security, data encryption at rest and in transit, and access controls.

# Platform Security

Mailofly is architected from the ground up with defense-in-depth security to protect your sender reputation and subscriber data.

***

## Encryption Standards

* **In Transit**: All API traffic, dashboard sessions, and SMTP connections require modern TLS (TLS 1.2 or TLS 1.3) with strong cipher suites. Unencrypted plaintext connections are rejected.
* **At Rest**: Database tables, email logs, and OAuth tokens are encrypted using AES-256 with keys managed in hardware security modules (HSM).

***

## API Key Security

* **Prefixing**: All live keys use standard `mf_live_` prefixes for easy identification in secret scanners.
* **Granular Scopes**: Generate keys restricted solely to sending mail or read-only access for analytics.
* **Secret Detection**: Mailofly actively scans GitHub public repositories for leaked API keys. If your key is detected publicly, it is automatically revoked to prevent abuse.

***

## Infrastructure Hardening

* Multi-tenant data isolation with strict row-level security (RLS).
* Automatic rate-limiting and DDoS mitigation through Cloudflare.
* Regular third-party penetration testing and vulnerability assessments.


## Related topics

- [API Key Security](/guides/api-keys/api-key-security.md)
- [Delivered Email Not Arriving](/guides/deliverability/delivered-email-not-arriving.md)
- [Configure webhook](/receiving/configure-webhook.md)
- [Open Rates Not Accurate](/guides/deliverability/open-rates-not-accurate.md)
- [TLS](/domains/tls.md)