Security
Built so you can
trust the platform.
MailerSpark is self-hostable and runs in your control. Encryption at rest, signed webhooks, SSRF-scanned endpoints, cross-tenant IDOR guards — security is in the architecture, not a checkbox.
What's in place
Security by default
Encryption at rest
SMTP passwords, OAuth tokens, and API key secrets are encrypted at rest. Fallback key derivation for migrations.
SSRF protection
Webhook endpoint URLs are SSRF-scanned. Private IPs, link-local, localhost, and metadata endpoints are blocked.
Cross-tenant IDOR guards
Every API route and dashboard action enforces organization scope. No way to read another tenant's data.
Signed webhooks
HMAC-SHA256 with timestamp. Replay-resistant. Failed deliveries retry with exponential backoff.
Verified SES SNS
Inbound bounce/complaint webhooks verify the SNS signature and are org-scoped before processing.
Rate limits
Redis-backed per-API-key and per-IP rate limits on auth, public, and v1 routes. 429s are visible, not silent.
Custom JWT sessions
Cookie-based (ms_session, httpOnly). Email verification on registration. bcrypt for passwords.
Audit log
Available on Business and above. Tracks every meaningful change: contacts, campaigns, team, billing.
Self-hostable
One Docker Compose file. Postgres + Redis + web + worker bundled. Coolify-native deployment guide included.
Responsible disclosure
Found a security issue? Email security@mailerspark.app with a clear description and steps to reproduce. We respond within 48 hours and credit researchers in our public changelog when a fix ships.
Please don't open a public GitHub issue for security findings.
Open standards
Your data, your control.
Self-host or use the managed cloud. Either way, you own the data and the keys.