How we protect this.

Reporting a vulnerability

Send it to hello@voff.digital. Include what you found, how to reproduce it, and what an attacker could do with it. We aim to acknowledge within two business days and to tell you what we intend to do about it once we've reproduced it.

Safe harbour

If you make a good-faith effort to follow this policy, we will not pursue legal action against you for your research, and we will work with you to understand and fix the issue. Tell us before you go public, and give us a reasonable window to ship a fix.

In scope

• The Sendwax web application and dashboard.
• The public API.
• Authentication, session handling and API key handling.
• Tenant isolation — anything that lets one workspace reach another's data.

Out of scope

• Denial of service, volumetric or stress testing. Do not run these against production.
• Social engineering of our team, our customers or our providers.
• Findings that only affect out-of-date browsers, or reports generated by a scanner with no demonstrated impact.
• Missing hardening headers or cookie flags with no exploitable consequence.
• Vulnerabilities in third-party services — report those to the provider.

Test against your own workspace and your own domains. Do not access, modify or retain data that isn't yours; if you come across someone else's data, stop and tell us.

Platform security

• Transport. All traffic to the dashboard and API is served over TLS.
• Passwords. Hashed with bcrypt. We never store them in a recoverable form, and a reset link is single-use and time-limited.
• API keys. Shown once, at creation, and stored only as a SHA-256 hash. We cannot recover a lost key — you revoke it and issue a new one. Keys are scoped to a workspace.
• Webhooks. Every outbound payload is signed with HMAC-SHA256 as Sendwax-Signature: t=<unix>,v1=<hex>. The timestamp is part of the signed material, so an old payload can't be replayed. Verify it with a constant-time comparison before you trust a delivery.
• Inbound events. Delivery notifications from AWS SNS are signature-verified before we act on them, so a forged notification can't mark a message delivered or suppress an address.
• Tenant isolation. Every query is scoped to the workspace that owns the record; workspace ownership is enforced at the data layer rather than left to individual controllers.
• Public forms. Sign-in, registration, password reset and the contact form are protected by Cloudflare Turnstile and rate limited.

Sending security

• Domain authentication. A domain has to pass SPF and DKIM before you can send from it, so mail leaving Sendwax on your behalf is provably yours.
• DMARC. We surface DMARC alignment so you can see whether receivers will treat your mail as authenticated.
• Suppression enforcement. Bounces, complaints and unsubscribes are enforced at send time, not left to the caller to check.
• One-click unsubscribe. Compliance endpoints are signed with an unguessable per-recipient token rather than a session, so they work from a mailbox provider's own button.

Access and operations

• Access to production systems is limited to people who need it to run the service.
• Credentials for third-party providers are held in environment configuration, never in the code repository.
• Infrastructure and dependencies are patched as updates become available.

Incident response

If we confirm a breach affecting your data, we will notify affected customers without undue delay, and within any period the applicable law requires. The notice will say what happened, what data was involved, what we've done, and what you should do. Status during an incident is posted on the status page.

Your part

• Treat API keys as secrets: server-side only, never in client code or a public repository.
• Issue separate keys per environment, and revoke ones you no longer use.
• Verify webhook signatures before acting on a payload.
• Keep your DNS records under control — an abandoned subdomain pointing at a service you no longer own is how domains get taken over.