Security

What protects the email, contacts and events you put into Waymail, how to tell us about a problem, and where we still fall short.

Last updated 11 September 2026

1. Where your data lives

Each workspace belongs to one region, chosen when it is created and fixed afterwards. Everything that touches a message — the API, the database, message storage, queues and Amazon SES — runs inside that region. For the EU region that is Amazon Web Services in Frankfurt (eu-central-1). Only the EU region is open today.

The marketing site and the console are static files served from CloudFront's global network. They hold no customer data: the console is JavaScript that runs in your browser and talks straight to your workspace's regional API. Nothing on the global tier stores a message, an address or an event.

2. Encryption

In transit. waymail.app and the console are served over HTTPS only; plain HTTP is redirected, and HSTS tells browsers to use HTTPS for a year, subdomains included. The API accepts HTTPS only. Outbound email is sent with TLS required, so a message is not handed to a recipient's mail server over a plaintext connection.

At rest. Each region has its own key in AWS Key Management Service, rotated automatically. The database, the bucket that holds message bodies, every queue and the backups are encrypted with it. The message bucket blocks all public access, refuses connections without TLS, and keeps versions. Webhook signing secrets are encrypted with the same key, bound to their workspace, so a ciphertext lifted from one workspace's record cannot be decrypted as another's.

3. Credentials

API keys are 240 bits of random material and carry their region and mode in the name — wm_eu_live_… — so a key presented to the wrong region is refused before anything is looked up. We store only a SHA-256 hash of the key and a short display prefix. The full key is shown once, when it is created, and cannot be retrieved afterwards. Each key holds the scopes you give it, such as email:send or email:read, and can be revoked at any time; creation and revocation are recorded in the audit log. Keep keys on your servers, never in a browser or an app.

Console sign-in is provided by Clerk, with Cloudflare Turnstile telling people from automated sign-ups. A Clerk session token lasts about a minute and is refreshed on each request rather than stored. A credential you paste into the console is kept in session storage only, and goes when the tab closes; the Cookie Policy lists every item the console keeps.

4. Access and accountability

Roles. Each member of a workspace has one role — owner, admin, member or viewer — and owners and admins control who belongs to the workspace and what each member may do.

Audit log. Actions that change what a workspace is — creating or revoking an API key, adding a domain, changing a webhook, removing an address from the suppression list, sharing a message, changing members, roles or settings — are recorded with who did it (a user, a key or the system), what was acted on, when, the source IP address and the request ID. An entry never contains a secret, a message body, or a recipient address other than the one the action was about. The log is kept for 400 days and is yours to read in the console.

Operational logs record each API request's endpoint, result, duration and workspace for 90 days. They are built to leave out message content, recipient addresses and credentials, and error messages are scrubbed of email addresses before they are written.

The AWS account keeps a CloudTrail trail of every management call across all regions, with log-file validation so tampering would show, for 400 days. Access to production systems is restricted to the people who operate them.

5. Webhooks

Every delivery carries a waymail-id, a waymail-timestamp and a waymail-signature: an HMAC-SHA256 over the ID, the timestamp and the body, so a captured delivery cannot be replayed or its body moved onto another event. The reference verifier in the documentation rejects a delivery whose timestamp is more than five minutes old.

You can rotate an endpoint's secret through the API without dropping a delivery: the previous secret stays live for an overlap you choose — 24 hours by default, up to 7 days, or none when a secret has leaked — and during it each delivery is signed with both, so you deploy the new one when it suits you.

6. Browser protections

Every response from waymail.app and the console carries HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff and a strict-origin-when-cross-origin referrer policy. The console adds a Content-Security-Policy that allows scripts only from the console itself, Clerk and Turnstile; connections only to Clerk and the regional APIs; no plugins; and no embedding by any other page (frame-ancestors 'none'). The files themselves sit in a private bucket reachable only through CloudFront.

7. Resilience and monitoring

• The database has point-in-time recovery — continuous backups for 35 days — and deletion protection; the buckets keep versions; the infrastructure stacks carry termination protection, so a stray command cannot remove them.
• Every asynchronous queue has a dead-letter queue and two alarms: one when a message lands in it, one when the oldest message is older than it should be. Alarms go to an address a person reads.
• A monthly budget warns at 80% of the expected spend and when the forecast passes 100%, because on pay-per-use infrastructure a climbing bill is a loop, a leak or an attack.
• Each workspace's bounce and complaint rates are watched and acted on at the thresholds in the Acceptable Use Policy, so one list cannot harm everyone's deliverability.

8. Retention controls

You choose how long message bodies are kept — 7, 30, 60 or 90 days, or not at all beyond sending. Delivery history is kept for your plan's period. Expiry is carried out by the storage itself — S3 lifecycle rules and DynamoDB time-to-live — rather than by a job that could stop running. When a workspace is closed, its data is deleted within 30 days and backups age out within a further 35. The Privacy Policy lists every period.

9. Reporting a vulnerability

If you find a security problem in Waymail, write to hello@waymail.app, in English or Norwegian. The same address is published in our security.txt. Please include what you found, the URL or endpoint, the steps to reproduce it, what you think the impact is, whether you saw any data that was not yours, and how we can reach you.

We aim to acknowledge a report within three business days, to tell you what we found, and to tell you when it is fixed. We will credit you if you want to be credited.

We ask that you do not access, change or keep data that is not yours beyond what is needed to show the problem; that you do not run denial-of-service or load tests, which the Acceptable Use Policy forbids; and that you do not publish the problem before it is fixed and we have agreed the timing. We will not take legal action over research that follows these rules and is carried out in good faith.

10. What we do not yet have

Waymail is in private alpha, and it is fairer to say this plainly than to let you find out.

• No SOC 2 report and no ISO 27001 certification. The measures above are ours to describe, not yet a third party's to attest to.
• No published penetration test.
• No bug bounty. We thank and credit reporters; we do not pay them.
• No service-level commitment during the private alpha, as section 7 of the Terms says.
• One region. A workspace's data cannot yet be placed anywhere but the EU.

When any of these changes, this page will say so.

11. Contact

Security questions and reports: hello@waymail.app. If you believe your workspace has been compromised, revoke the affected keys first, then write to the same address. Our legal identity is on the Company Details page.