Security and compliance
Built with the assumption that every input is hostile.
EU-hosted by default
Sending infrastructure and stored metadata stay in EU regions. No data leaves the EU without your explicit configuration.
Header injection protection
Subject, from, and every custom header is validated against carriage returns and control characters at the schema layer, not the provider layer.
SSRF protection with IP pinning
Webhook and attachment URLs are resolved, checked against private and reserved ranges, and the checked IP is held for the connection so DNS rebinding cannot bypass the check.
Mandatory tenant scoping
Every repository method requires an account ID. Cross-account access returns 404, never a distinguishable error.
Indistinguishable key errors
An unknown API key and a revoked API key return the identical error, so a response can never confirm that a key once existed.