Security Overview

Infrastructure & Hosting

• The application and PostgreSQL database are hosted on Railway (United States).
• Uploaded email HTML and rendered screenshots are stored in Amazon Web Services S3 (United States).
• Email-client rendering runs on EmailQA-operated infrastructure hosted with Liquid Web (United States). The render service is reachable only over TLS at a dedicated domain; its direct service port is firewalled from the public internet.
• Production infrastructure access is limited to EmailQA-authorized personnel.

Encryption

In transit

• All traffic to the application, API, and render infrastructure is served over HTTPS (TLS).
• HTTP Strict Transport Security (HSTS) is enforced.

At rest

• Third-party credentials you connect (ESP and integration API keys, OAuth tokens) are encrypted with AES-256-GCM authenticated encryption before storage.
• EmailQA API keys are stored only as SHA-256 hashes; the full key is shown once at creation and cannot be retrieved afterwards.
• Magic-link sign-in tokens are stored hashed, are single-use, and expire.
• Passwords for password-protected share links are hashed with scrypt and verified in constant time.

Access Control & Authentication

• Passwordless authentication. EmailQA does not store account passwords. Sign-in uses expiring single-use magic links or OAuth (Google, GitHub).
• Project-level authorization. Every project API route verifies the caller is the project owner or an invited team member before returning content.
• Guest reviewers access only the specific project shared with them, via unguessable tokenized links; share links can additionally be password-protected. Guests cannot enumerate or access other projects.
• Administrative access to EmailQA's own admin tools is separately authenticated and restricted to EmailQA personnel.
• API access is scoped to the key owner's account and subject to per-plan rate limits.

Application Security

• Security headers on all responses: HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a Content-Security-Policy restricting base URI, object embedding, and framing.
• Rate limiting on authentication endpoints and the API, including per-recipient caps on sign-in emails to prevent abuse.
• Authentication endpoints are designed to prevent account enumeration.
• Server-side request forgery (SSRF) protections on features that fetch user-supplied URLs (private IP ranges and internal hosts are blocked).
• Input validation with schema-based parsing (Zod) on API endpoints.
• Periodic internal security and compliance audits of the codebase against our published policies; findings are tracked to resolution.

Data Handling & Sub-processors

• Customer email content is processed only to provide the Service: rendering previews, screenshots, link and accessibility checks, and the collaboration features you use. We do not sell customer data or use email content for advertising.
• Content sent to third-party integrations (ESPs, Slack, project-management tools) is transmitted only when you connect the integration and only at your direction.
• Our AI-assisted features use Anthropic's commercial API, which does not train on submitted content.
• A current list of sub-processors, with purpose and location, is maintained at emailqa.live/legal#subprocessors. Business customers can subscribe to change notifications.

Data Retention & Deletion

Retention windows are enforced automatically by scheduled cleanup jobs:

• Account deletion is self-serve. It removes personal data from production systems within 30 days — including associated files in object storage — and from routine backups within 90 days, except where retention is required by law.
• Deleting a project deletes its stored content, including uploaded HTML and screenshots.
• Customers can export their project data; contact [email protected] for assistance with bulk exports.

Incident Response & Breach Notification

In the event of a personal data breach likely to result in a risk to affected individuals, EmailQA will notify affected customers and, where required, the appropriate supervisory authority without undue delay — and in any event within 72 hours of becoming aware of the breach where feasible — consistent with GDPR Arts. 33–34, UK DPA 2018, and applicable US state breach-notification laws. The same commitment is made contractually in §8 of our DPA.

Compliance Posture

• GDPR / UK GDPR: a Data Processing Addendum incorporating the EU Standard Contractual Clauses (2021/914, Module 2) and the UK International Data Transfer Addendum is part of our terms; a countersigned copy is available on request.
• CCPA: we do not sell or share personal information as defined by the CCPA/CPRA.
• Certifications: EmailQA has not yet undergone an independent SOC 2 or ISO 27001 audit. Our infrastructure sub-processors (including AWS, Railway, and Stripe) maintain their own third-party attestations. We are happy to complete security questionnaires — contact [email protected].

Vulnerability Disclosure

We appreciate responsible disclosure. If you believe you have found a security vulnerability in EmailQA, please report it to [email protected] and allow us reasonable time to remediate before public disclosure. Our machine-readable policy is published at /.well-known/security.txt.

Security Contact

For security assessments, questionnaires, DPA countersigning, vulnerability reports, or any other security-related inquiry: [email protected]. Security inquiries are handled directly by the founder.