Security

Mailkick is designed for teams that care about their customers' data as much as we do. This page describes the technical and organizational measures we use to protect your content, your accounts, and your operations.

Infrastructure & Hosting

All customer data — accounts, emails, components, images, and related assets — is stored exclusively in the European Union, in AWS eu-west-3 (Paris, France), operated by our primary infrastructure provider Supabase.

The web application is delivered through Vercel's global edge network for performance, and serverless API routes run on Vercel infrastructure. No persistent customer data is stored outside the EU.

Encryption

• In transit: TLS 1.2+ on all public endpoints. HTTPS is enforced with HSTS (max-age=63072000; includeSubDomains; preload).
• At rest: AES-256 encryption on all databases and object storage, managed by our infrastructure providers.
• Secrets: API keys and service credentials are stored as environment variables in Vercel and Supabase, never committed to source control.

Authentication & Access Control

• User authentication: Supabase Auth — email + password, magic links, and Google OAuth.
• Session management: Secure, HTTP-only cookies and short-lived JWT tokens with refresh rotation.
• Row-Level Security (RLS): Enforced at the database level on all tables containing customer data. Users can only access data belonging to their own account.
• Team access: Each account is isolated. Members are invited explicitly and their permissions are scoped to their account.
• Internal access: Only Mailkick's tech team has production database access, used exclusively for debugging and support on explicit customer request.

Application Security

• Input validation: User input is validated server-side using Zod schemas and sanitized before storage or rendering.
• XSS protection: HTML content generated from user input is escaped or sanitized via strict allow-lists.
• Security headers: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Strict-Transport-Security are applied globally.
• Rate limiting: Applied on costly operations (AI generation, email sending, external scraping) to prevent abuse.
• Dependency audit: npm audit runs on every pull request; high-severity vulnerabilities are addressed promptly.

Backups & Disaster Recovery

• Daily automated backups of the primary database, retained by Supabase for 7 days.
• Object storage is replicated by the provider for durability.
• Source code is versioned on GitHub and deployable in minutes from any commit.

Monitoring & Incident Response

• Error monitoring: Sentry captures application errors in real time with privacy-aware sampling.
• Analytics: PostHog records pseudonymized product usage events; IP addresses are not stored long-term.
• Incident notification: Affected customers are notified within 24 hours of confirmed incidents that impact their data.

Sub-processors & Vendor Security

Mailkick relies on a small number of carefully selected sub-processors. All of them are under data processing agreements and hold industry-standard security certifications (SOC 2 Type II, ISO 27001, or equivalent). See our full sub-processors list.

Compliance

• GDPR: Mailkick is operated from France and hosts all customer data in the EU. Data subject rights (access, deletion, portability, rectification) are supported on request.
• DPA: A Data Processing Agreement is available for enterprise customers on request.
• Sub-processors: Our providers (Supabase, Vercel, Sentry, etc.) hold SOC 2 Type II and / or ISO 27001 certifications.

Responsible Disclosure

We welcome reports from security researchers. If you believe you have found a security vulnerability in Mailkick, please contact us at contact@mailkick.app with a clear description, steps to reproduce, and any supporting evidence.

Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate it. We will acknowledge your report within 72 hours.

Contact

For any security-related question, please reach out to: