Security
Updated October 9, 2026
I recognise the importance of excellent security practices. This document aims to clarify how your data is protected.
General security practices
- Access to servers, source code, and third-party tools are secured with two-factor authentication whenever possible.
- I use strong, unique, and randomly-generated passwords.
- Automated security vulnerability detection tools alert me when app dependencies have known security issues. Patches are applied and deployed promptly.
- Production data stays on our production systems. It's never copied to laptops or other external devices.
Protecting your account
- Passwords are stored as salted bcrypt hashes, never in plain text.
- Two-factor authentication is available with an authenticator app (backed up by single-use recovery codes) or a security key.
- Sensitive forwarders can be password protected. Their details and messages stay hidden until you confirm your password, even while you're signed in, and lock again after 30 minutes away.
- API tokens you create have full access to your account. Treat them like passwords and revoke any you no longer use.
Hosting and encryption
Vend Email runs on Hetzner cloud servers.
- In transit: every connection uses HTTPS. Traffic is encrypted with a Let's Encrypt certificate that renews automatically, and HTTPS is enforced in the browser with HSTS. The app also connects to its database over TLS with full certificate verification.
- Database: your account details and messages are stored in PlanetScale for Postgres, which encrypts data and backups at rest.
- Files: the original copies of messages in your mailbox, their attachments and link screenshots are stored in Cloudflare R2, encrypted at rest with AES-256.
- Internal services: background jobs and their queue talk to each other over a private network, not the public internet.
What kind of data we collect
When you sign up to Vend Email, we collect the minimum necessary information to get your account set up:
Payment information is handled securely by our third-party payment processor, Stripe. Vend Email does not store sensitive payment details.
No one. Your personal information and email routed through Vend Email via Mailgun are not sold, read, or shared with third-parties. I'm not in the business of selling your data.
Information about how users are interacting with the app is collected using Google Analytics to help improve the product and provide faster, more effective support when issues arise.
See the Privacy Policy for further information.
How do I report a potential vulnerability or security concern?
Please email support@vend.email if you have any concerns.
Further questions?
Great! Please contact me, and I'll happily update this doc.