How Milesender protects your sending.
The practical measures behind the product, not marketing language — this is what actually runs.
Workspace isolation
Your data is kept separate from every other customer's, and that separation is enforced on every request.
Encryption
Data is encrypted in transit (TLS) between your services, Milesender's API, and our infrastructure, and at rest on disk. SMTP credentials and API keys are stored as salted hashes — we can verify them, we can't read them back.
Authentication
Dashboard sessions use httpOnly, same-site cookies. API access uses scoped bearer keys you generate and can rotate or revoke at any time from Settings, with no shared or default credentials.
Domain authenticity
Production sending is locked behind SPF, DKIM, and DMARC verification per domain — Milesender won't relay mail from a domain until you've proven ownership via DNS, which also protects your domain's reputation from misuse.
Audit visibility
Key creation, rotation, and revocation, domain verification, and team membership changes are logged and visible in Settings → Security, so you can see who did what and when.
Responsible disclosure
If you find a security issue, email us before disclosing publicly. We aim to acknowledge reports within 2 business days and will credit reporters who work with us in good faith.
Found an issue? security@milesender.dev