Security

Infrastructure

• Hosted on Vercel (application) and Neon (managed PostgreSQL) — both SOC 2 Type II attested.
• All traffic is served over TLS 1.2+; HSTS is enforced.
• Database connections require TLS and channel binding.
• Backups run continuously with point-in-time restore to any moment in the last 7 days; nightly snapshots retained for 30 days.

Data at rest

• Database volumes are AES-256 encrypted by the storage provider.
• Third-party API keys (email providers, contact enrichment providers, Maribiz) are encrypted at the application layer before being written to the database — even a full DB dump does not expose them in plaintext.
• Passwords are hashed with bcrypt.

Access control

• Workspace data is scoped by workspaceId on every query — cross-workspace reads are structurally impossible.
• Super-admin access is limited to named engineers and audit-logged.
• Production database credentials are stored in a secret manager; no engineer has standing prod access.

Application

• All input is validated with Zod schemas at the API boundary.
• Prisma parameterises every query — no raw SQL from user input.
• Session cookies are httpOnly, secure, SameSite=lax.
• Rate limiting protects login, credit-spending endpoints, and public forms.

Email deliverability

MariMail sends through your connected mailboxes or ESPs — we never hold or reuse recipient lists across workspaces for our own sending. Bounces and unsubscribes are honoured platform-wide.

Incident response

If we detect a security incident affecting your data, we will notify the workspace owner within 72 hours with a description of the scope, what we know, and remediation steps.

Reporting a vulnerability

If you find a security issue, please email [email protected]. We do not currently run a public bug bounty but we respond to every report and acknowledge researchers who report responsibly.