Security Policy

Last Updated: March 31, 2026

AES-256 Encryption bcrypt Hashing Multi-Tenant Isolation Secure SMTP Storage

At Email Pro SaaS, we take security seriously. This document outlines our security practices and commitments to protecting your data.

1. Data Encryption

SMTP Credentials

All SMTP passwords are encrypted using AES-256-CBC before being stored in our database. Encryption keys are managed securely and never exposed in logs or error messages.

User Passwords

User passwords are hashed using bcrypt with automatic salt generation. We never store plaintext passwords.

Data in Transit

All data transmitted between your browser and our servers is protected by SSL/TLS encryption.

2. Multi-Tenant Isolation

Tenant Separation

Each user's data is isolated using a unique tenant_id. Database queries are scoped by both username and tenant_id to ensure complete data isolation between accounts.

Access Controls

Users can only access their own SMTP settings, email history, subscriber lists, and usage data. Cross-tenant access attempts are blocked at the application level.

3. Authentication & Authorization

Session Management

User sessions are managed securely with httpOnly cookies. Sessions expire after inactivity and can be invalidated on logout.

Role-Based Access

Access to features is controlled by plan tiers (Starter, Growth, Pro). Unauthorized feature access attempts are blocked at the server level.

4. Input Validation & Sanitization

SQL Injection Prevention

All database queries use parameterized statements to prevent SQL injection attacks.

XSS Prevention

User inputs are sanitized before storage and output encoding is applied when displaying data in the UI.

CSRF Protection

All state-changing requests require a valid CSRF token generated for each user session.

5. Rate Limiting & Abuse Prevention

API Rate Limits

Endpoints are protected by rate limiting to prevent abuse and ensure fair usage across all tenants.

Threat Detection

System monitors for suspicious patterns including blocked word detection in email content and anomaly detection in sending behavior.

6. Audit Logging

Activity Tracking

Key actions including login attempts, SMTP changes, and plan upgrades are logged for security auditing purposes.

7. Infrastructure Security

Servers are hosted in secure data centers with physical access controls
Database backups are encrypted and stored securely
Security patches and updates are applied regularly
Firewalls and intrusion detection systems are in place

8. Your Responsibilities

Use strong passwords: Choose unique, complex passwords for your account
Protect SMTP credentials: Do not share your SMTP username/password
Monitor account activity: Review your email history regularly
Report suspicious activity: Contact us immediately if you notice unauthorized access

9. Incident Response

In the event of a security incident:

We will notify affected users within 72 hours
We will take immediate steps to contain and remediate the issue
We will provide transparent communication about the incident
We will implement measures to prevent future occurrences

10. Compliance

We are committed to complying with relevant security standards and regulations including:

GDPR (for EU users)
CAN-SPAM Act (for US email sending)
Industry standard security practices

Report Security Issues

If you discover a security vulnerability or have security concerns, please contact us immediately at [email protected]