Security overview

This page describes practices we actually implement. We do not claim SOC 2, ISO, or other certifications here unless we link to a current report — and we are not publishing fake badges.

Accounts & authentication

• Password credentials are stored as one-way hashes (bcrypt), not plaintext.
• Magic-link sign-in uses short-lived tokens delivered only to the claimed email address.
• Session auth is handled via NextAuth with server-side session checks on app routes.
• We do not require Google or Microsoft OAuth — you can use a work email directly.

Data & subprocessors

• Application data lives in a managed Postgres database under our hosting stack.
• Email is delivered through Amazon SES on platform infrastructure you do not configure yourself.
• Payments and subscription state go through Stripe; we do not store full card numbers.
• We do not sell your contact lists.

Sending & abuse controls

• Purchased, rented, or scraped lists are prohibited in our terms.
• Campaigns that exceed bounce or complaint thresholds are auto-paused.
• Hard bounces and complaints feed suppression so we avoid re-mailing known bad addresses.
• New accounts ramp daily send volume gradually to reduce sudden reputation risk.

What we will not claim

We will not invent uptime SLAs, penetration-test scores, or enterprise compliance seals on this page. If you need a DPA, security questionnaire, or subprocessors list for procurement, contact us and we will answer with current facts.

Report a concern

Email security@sendfable.com for suspected vulnerabilities or abuse. For privacy requests, see our Privacy Policy.