Security & reliability
CapiMail handles email your product depends on, so we hold ourselves to clear, verifiable controls. This page is deliberately honest: it separates what is available today from what is still in progress and what we do not yet have. We will not claim a certification or guarantee we cannot back up.
Available today
Access control
- Scoped API keys (cm_test_ and cm_live_), bound to one organization, revocable and expirable at any time.
- Test mode is fully isolated from live sending, so you can integrate without touching real recipients.
- Organization-scoped authorization on every request; sending requires review and approval.
- Role-based access for owners and admins on account and billing operations.
Data protection
- Encryption in transit over TLS, with HTTP Strict Transport Security enforced.
- Hardened browser security headers, including Content-Security-Policy, strict transport security, and framing and content-type protections.
- Configurable retention: delivery payloads are eligible for deletion after your workspace window (30 days by default, 1–90 days configurable); provider event logs default to 90 days.
- We do not sell personal data and do not use your recipient lists for our own marketing.
Sending integrity
- Domain authentication with SPF, DKIM, and DMARC; DKIM is verified before any live traffic is sent.
- Idempotency keys so a retried request never sends the same email twice.
- A durable queue with backoff retries and reconciliation for delivery.
- Suppression and consent enforcement, plus per-organization sending and rate limits.
- Signed outbound webhooks and authentic provider delivery events, never invented dashboard numbers.
Operational monitoring
- Bounce, complaint, and queue-depth alarms route to the on-call operations inbox.
- An auditable credit ledger for every purchase, reservation, and charge.
- Automatic credit refunds on hard bounces.
- Email delivery runs in a single, declared cloud region; the specific region is shared with customers on request.
In progress
Being built now; not something we claim as finished yet.
- A published service-level agreement (SLA) with response commitments.
- A documented incident response and customer-notification process.
- Data Processing Agreement (DPA) and a reusable security questionnaire for teams.
- A longer public uptime and incident history on the status page.
Not yet held
We do not have these today. They are milestones for when customer demand and scale justify the investment; we would rather be upfront than imply otherwise.
- SOC 2 Type II report: not held.
- ISO 27001 certification: not held.
- Independent third-party security audit: not yet conducted.
Subprocessors & data handling
CapiMail relies on a small, vetted set of infrastructure categories to run the service:
- Authentication and database provider
- Email delivery provider
- Application and worker hosting provider
- Payment processor (used only when you purchase credits)
You remain the controller of your recipient data; CapiMail processes it on your behalf. The named list of subprocessors, their regions, and data-residency details are available to customers on request (under NDA where appropriate). We will give customers advance notice before adding or changing a subprocessor that processes their data. See our Privacy Policy or contact us before sending restricted data.