Trust & security
Security and data protection
Your contacts and campaigns are your business. Here is how InboxRoads protects them.
Encrypted connections
The platform is served over HTTPS with HTTP Strict Transport Security, and sessions are encrypted.
Encrypted secrets
Sending-provider credentials, API secrets and DKIM private keys are encrypted at rest and never shown to customers or written to logs.
Tenant isolation
Every contact, list, campaign and domain belongs to one account. Authorization policies check ownership on every request.
Two-factor authentication
Administrator accounts must use time-based one-time passwords (TOTP) from an authenticator app.
Private tracking links
Open, click and unsubscribe links use random tokens — recipients’ email addresses never appear in tracking URLs.
Signed, expiring downloads
Verification results and exports are kept in private storage and delivered through signed links that expire.
Abuse and rate limiting
Login, sign-up, API and public tools are rate limited; campaigns pause automatically if bounce or complaint rates spike.
Audit logs
Logins, credit changes, campaign launches, domain changes and configuration updates are recorded for review.
Verified webhooks
Payment and email-provider webhooks are signature-checked before they can change anything.
Your data, your control
You own the contacts you upload. We use them only to provide the service — verifying addresses and sending the campaigns you create — as described in our privacy policy. You can export or delete contacts at any time from your account.
Responsible sending
Protecting sender reputation protects every customer. Our acceptable use policy requires permission-based sending, and the platform enforces unsubscribe links, one-click unsubscribe headers and automatic suppression of bounces and complaints.
Reporting a vulnerability
If you believe you have found a security issue, please email support@inboxroads.com with the details. Please give us reasonable time to investigate before disclosing it publicly.