Security & Compliance

Last Updated: April 6, 2026

This page summarizes how Email Pro SaaS protects data, enforces safe sending, and supports regulatory compliance.

Note: This document describes our controls and policies. It does not constitute legal advice. Customers should consult counsel for specific compliance obligations.

1. Security Controls

Encryption

SMTP passwords are encrypted using AES-256-CBC. User passwords are hashed with bcrypt. Data in transit is protected via TLS.

Tenant Isolation

All customer data is scoped by a tenant identifier to prevent cross-account access.

Session & CSRF Protection

Secure sessions and CSRF tokens are enforced across state-changing actions.

2. Abuse Prevention & Deliverability Protection

Daily sending caps per plan with category tracking (Instant, Bulk List, Manual).
Scheduling reservations to prevent over-commitment.
Content safety checks to block prohibited terms.
Automated pacing for large sends to protect SMTP and deliverability.

3. Location-Based Controls

Country blocking via `BLOCKED_COUNTRY_CODES` (GeoIP-based).
IP blocking via `BLOCKED_IPS` for targeted abuse mitigation.
Audit logging for blocked attempts with IP, country, path, and user-agent.

4. Audit & Monitoring

Admin audit logs capture sensitive actions and security blocks.
Blocked attempts are recorded with timestamps and request metadata.
Admins can review logs at /admin/audit-logs.

5. Compliance Support

CAN-SPAM: Unsubscribe links are included in outbound emails.
GDPR: Data minimization, export, and deletion controls are available on request.
Privacy: We do not sell customer data. See Privacy Policy.

6. Customer Responsibilities

Maintain compliant email content and opt-in lists.
Configure SPF/DKIM/DMARC for sending domains.
Warm up new domains and monitor deliverability.

7. Incident Response

We investigate suspected abuse and security incidents quickly and can restrict accounts if repeated violations are detected.

Contact

For security or compliance questions, please reach out to [email protected] or via your dashboard support channel.