Security
Your mailboxes are your reputation. We treat them that way.
Mailnitrix holds the keys to the mailboxes you send from. Here's how we look after them, and your data.
Encrypted in transit
The website, the app and our API are served over HTTPS only. Connections to Gmail and Microsoft use TLS for sending (SMTP) and for warmup (IMAP).
Credentials encrypted at rest
Mailbox app passwords and Microsoft tokens are encrypted with authenticated encryption (Fernet: AES with HMAC-SHA256) before they reach the database. The key is stored separately from the data.
No Microsoft passwords
Outlook and Microsoft 365 mailboxes connect through Microsoft's own sign-in with PKCE. We only ask for what sending and warmup need, and you can revoke access at any time.
Short-lived sessions
Account passwords are hashed with bcrypt. Sign-in sessions use access tokens that expire after 15 minutes and are renewed securely.
Files are never stored
Lead files are read in memory and discarded. Only the rows you import are saved, and you can edit or delete them at any time.
Minimal tracking
Open tracking records the time, IP address and browser of each image request so machine opens can be filtered. Warmup emails are never tracked, and tracking can be switched off per campaign.
Responsible disclosure
Found a vulnerability?
Please tell us privately before sharing it anywhere else, and give us reasonable time to fix it. We won't take action against good-faith research that respects our users' data.
Email the details, including steps to reproduce, to
security@mailnitrix.com- • Don't access, change or delete data that isn't yours.
- • Don't run tests that degrade the service for others.
- • Don't send email through other people's mailboxes.