Security
Last updated: September 2026
How AuthoriseMail protects your data. We describe only measures we have actually implemented — we do not claim certifications we have not obtained.
1. Application security
- Passwords stored using strong one-way hashing; never in plain text.
- API keys stored hashed and revocable.
- Security headers on every response, brute-force lockout, and per-IP rate limiting.
- Server-side authoritative credit ledger preventing client-side tampering.
2. Data security
- Encryption in transit (TLS).
- Least-privilege access to production systems.
- Audit logging of sensitive actions.
3. Availability
The Service is engineered with global exception isolation so individual failures do not crash the API, and background workers process bulk jobs with retry/refund safeguards.
4. Incident response
We maintain a breach-response process and will notify affected users and regulators where legally required (see GDPR & Data Protection).
5. Responsible disclosure
Found a vulnerability? Email support@authorisemail.com with subject “Security report”. We ask that you give us a reasonable window to remediate before public disclosure.
This document is provided as a professional template for AuthoriseMail and should be reviewed by qualified legal counsel before production launch.