Security
Security at Mail.Land
The controls we operate today, written for security reviews and vendor questionnaires. We list only what is in place now, and we say where something is not available yet.
Certification status
Mail.Land holds no security certification today: no ISO 27001 certificate, no SOC 2 report and no published third-party penetration test. This page describes our controls as they stand. When that changes, this page will change with it.
Controls in place
Each item below describes a control that runs in production today.
Hosting and network
- Production systems run on Hetzner in Germany, in Nuremberg and Falkenstein. Our databases and mail servers are in Nuremberg.
- An encrypted secondary backup copy is kept on infrastructure we operate in Warsaw, Poland.
- Web traffic to the website, the dashboard and the API passes through Cloudflare, which provides DDoS protection.
- Servers are protected by firewalls, and automated detection blocks abusive connection attempts (CrowdSec) on the application and message-queue hosts.
Encryption
- Connections to the dashboard and the API use HTTPS.
- The SMTP relay accepts sign-in only after the connection is encrypted with STARTTLS.
- Delivery to recipients' mail servers uses TLS where the receiving server supports it.
- API keys are stored only as hashes, so they cannot be read back. Passwords are stored as bcrypt hashes.
- Two-factor authentication secrets and webhook signing secrets are stored encrypted.
- Off-site backups are encrypted before they leave our servers. We hold the keys; the storage provider does not.
Account security
- Two-factor authentication with an authenticator app is available to every user, with one-time recovery codes.
- Single sign-on with Google, Microsoft, Okta or any OpenID Connect provider is included on every plan. You can require SSO for your email domain, which turns off password sign-in for that domain.
- Team roles: Owner, Admin, Member and Viewer.
- An activity log records actions taken in your account.
- Repeated failed sign-in attempts are temporarily blocked.
Not available yet
- An account cannot yet require two-factor authentication for all of its members; each user turns it on for themselves.
- SAML single sign-on and passkeys are not supported.
API keys
- Each key can be limited to the API or to SMTP, to selected sending domains and to a list of allowed IP addresses.
- Keys can carry an expiry date and their own rate limits.
- When you rotate a key, the previous key keeps working for a grace period you set, so you can deploy the new one without downtime.
- A sandbox key set to log only lets you test without delivering any email.
Email authentication
- You can send only from a domain you have verified through DNS. Verification checks your SPF, DKIM, DMARC and return-path records.
- Mail.Land adds its own second DKIM signature to each message, so mailbox providers can tell which platform sent it.
Signed webhooks
- Event webhook requests are signed with HMAC-SHA256, using a secret unique to each webhook.
- The signature header carries a timestamp, so your endpoint can reject old or replayed requests. Our documentation recommends a five-minute window.
Abuse prevention
- Every customer agrees to our Acceptable Use Policy.
- Before an account is approved for sending, we screen the organisation and its beneficial owners against official sanctions lists.
- Links in campaigns, and tracked links when they are clicked, are checked against Google Web Risk for phishing and malware.
- Anyone can report abuse of the service through our abuse report form.
Operations
- Production services are monitored with centralised metrics, logs and alerts.
- Backup restores are rehearsed in isolated environments.
- Our .NET dependencies are scanned for known vulnerabilities in our build pipeline, and a high or critical finding stops the build.
- Access to production systems and personal data is limited to a small number of authorised staff.
Incident and breach notification
If a personal data breach affects your data, we notify you without undue delay after becoming aware of it, as Article 33(2) of the GDPR requires. The notice goes to your designated security contact or, if none has been designated, to your account's Owner and Admin users. Section 6 of the DPA sets out what the notice contains and how we help you meet your own obligations.
Report a vulnerability
If you find a security issue in Mail.Land, email us. Please include the steps to reproduce it and the parts of the service it affects. We aim to acknowledge reports within 72 hours and we follow coordinated disclosure. We do not run a paid bug bounty.
- Security contact:
- [email protected]
Security questionnaires
Send your questionnaire to our security contact. We answer from the facts on this page, in the DPA and in our Privacy Policy. For data protection questions, see our GDPR page.
Frequently asked questions
Do you have SOC 2 or ISO 27001?
No. Mail.Land holds no security certification today. This page lists the controls we operate instead.
Where is my data hosted?
Our production systems run on Hetzner in Germany, with an encrypted backup copy in Warsaw, Poland. Some providers, such as Cloudflare, Stripe and Google, may process limited data outside the EU. Our GDPR page lists each one.
Can we enforce two-factor authentication for our team?
Not yet. Every user can turn on two-factor authentication, and you can require SSO for your email domain, but an account cannot yet force two-factor authentication on all members.
Do you support SAML?
No. Single sign-on works with Google, Microsoft, Okta and any OpenID Connect provider.
How do I verify that a webhook came from Mail.Land?
Check the X-MLND-Signature header: an HMAC-SHA256 of the timestamp and the request body, keyed with your webhook's secret. Our documentation has examples in eight languages.
Questions about security?
Write to our security contact, or read the DPA for the full list of measures.