Security
Security
How Sendix protects your data and your recipients
Controls in place
- Encryption. TLS for the website, dashboard and API. Outbound mail upgrades to TLS whenever the receiving server supports it, and MTA-STS is enforced on our own domains.
- Credentials. Passwords are hashed with bcrypt. API keys and SMTP credentials are shown once and stored only as hashes. DKIM keys and other secrets use AES-256-GCM envelope encryption.
- Access control. Optional two-factor authentication, with a fresh code required for billing and account deletion. Role-based workspace permissions and OpenID Connect single sign-on.
- Infrastructure. Databases and queues listen only on local interfaces. Each service runs as its own unprivileged user behind a host firewall; sending nodes hold no database or signing secrets.
- Backups. Encrypted backups on a rolling 14-day window, kept on the primary server and copied to a second server in Türkiye.
- Audit trail. Sign-ins, credential changes, billing and operator actions are written to an audit log kept for 365 days.
- Abuse prevention. Verified domains are required to send. Rate limits apply per account, key and domain, and sending pauses automatically when bounce or complaint rates cross safe limits.
- Monitoring. API, queues, SMTP and sending nodes are probed continuously; the public status page is generated from those measurements.
The same measures are listed in Annex 2 of the Data Processing Agreement.
Availability over the last 30 days
Measured by our own status probes. These are historical figures, not a commitment. Live state is on the status page.
| Service | Availability | p95 latency |
|---|---|---|
| Domain Verification API | 99.85% | 80 ms |
| Sendix API | 100.00% | 24 ms |
| Webhook API | 100.00% | 21 ms |
| Outbound Mail Queue | 100.00% | 13 ms |
| SMTP Gateway | 100.00% | 21 ms |
| SMTP Submission | 100.00% | 56 ms |
| deneme Delivery Worker | 0.00% | — |
| Istanbul Delivery Worker | 97.56% | 258 ms |
| Izmir Delivery Worker | 99.97% | 293 ms |
| Dashboard | 100.00% | 33 ms |
| Sendix Web | 100.00% | 33 ms |
What we do not claim
- Sendix does not hold SOC 2, ISO 27001 or similar certifications.
- Availability figures are historical measurements. There is no uptime guarantee unless one is agreed in writing.
- Primary servers, databases and backups are in Türkiye; web traffic passes through Cloudflare’s global network. There is no selectable data region.
- Sendix is run by a single developer, who is the only person with production access.
Reporting a vulnerability
Email [email protected] with the affected endpoint, the impact and steps to reproduce. We acknowledge reports within 3 business days and will not take legal action against research done in good faith within these rules:
- Use only your own accounts and test data; never access other customers’ data.
- No denial-of-service, spam, social engineering or physical attacks.
- Give us reasonable time to fix the issue before disclosing it.