Security
Security controls for a system that handles inboxes, contacts, and automation.
MailSequence encrypts sensitive connection credentials, scopes access by organization and workspace, uses role-based permissions, records important changes, and signs outbound webhooks.
Encrypted credentials·Tenant-scoped access·Signed webhooks·Audit logs
Control model
Protect secrets, constrain access, and leave an operating trail.
Credentials encrypted at rest
OAuth tokens, mailbox credentials, provider connections, organization connectors, and webhook signing secrets use encrypted storage and are excluded from ordinary serialized responses.
Organization and workspace scope
Customer data and operating resources belong to a specific organization or workspace. The API key fixes that scope. A caller cannot select another workspace.
Role-based permissions
Workspace owners, admins, and members receive different permissions so every teammate does not need the same level of control.
Scoped API keys
API keys have workspace or organization tiers and capability scopes. Provisioning keys cannot become an unrestricted route into customer data.
Signed outbound webhooks
Webhook deliveries use HMAC signatures, retry failed deliveries, and disable persistently failing endpoints.
Audit logs
Important changes to campaigns, contacts, enrollments, inboxes, domains, team access, connections, and settings create an audit trail.
Mailbox connections
Connect Google and Microsoft through OAuth.
OAuth lets a mailbox provider authorize the connection without an operator handing MailSequence a consumer-account password. Access and refresh tokens are encrypted before storage.
- Provider authorization through Google or Microsoft
- Encrypted access and refresh-token storage
- Tokens hidden from API serialization
- Connection changes recorded in audit logs
Transparent boundary
Review the controls implemented today.
This page describes product controls verified in the application. It does not claim SOC 2, ISO 27001, HIPAA, or another independent certification that has not been established.
Need a technical review?
Ask about a specific control, deployment requirement, data flow, or vendor-review question. We will answer with the applicable implementation or documented boundary.
Using the developer platform?
Use scoped keys, idempotent writes, HMAC verification, secret rotation practices, and the public OpenAPI contract when building integrations.
Clarifying operational ownership? Read who owns cold-email deliverability.
FAQ
Frequently asked questions
Are mailbox and provider credentials encrypted?
Yes. OAuth tokens, SMTP/IMAP credentials, provider credentials, organization connector secrets, and webhook signing secrets use encrypted storage in the application.
Can one workspace access another workspace's data?
Product resources are scoped by organization and workspace. The authenticated API key fixes the tenant. A caller cannot change it with a workspace identifier.
What team roles are available?
Workspaces support owner, admin, and member roles, with permission checks controlling sensitive operations and team management.
How are webhooks secured?
Outbound webhook deliveries are HMAC-signed. Consumers should verify the signature before processing an event. Delivery retries and automatic endpoint disablement handle persistent failures.
Does MailSequence have SOC 2 or ISO 27001 certification?
No such certification is claimed on this page. Contact MailSequence if your vendor review requires current evidence for a specific control or certification status.
Where can I report a security concern?
Use the contact page and identify the message as a security concern so it can be routed appropriately. Do not include live passwords, API keys, or mailbox credentials in the message.
Have a specific security requirement?
Ask about the control, data flow, or review evidence your organization needs.