Security
Guarded like it's ours.
Most of what protects you on Transmit is the same thing that protects the inbox from bad senders. This page lists what we do, in plain words, and only the parts we can stand behind.
Your reputation is isolated
Every account sends from its own verified domain, with its own DKIM keys, and is tracked as its own tenant at the sending provider. No shared sending domains, no pooled reputation. A problem on another account cannot touch your deliverability.
- Card on file and domain ownership are verified before the first message leaves.
- Every accepted message is screened before a provider sees it. Held messages are shown to you with the reason.
- Bounce and complaint rates are enforced on every account. Sending is paused automatically when a list goes bad.
- SPF, DKIM, and DMARC are set up through the records you add at verification, so mail from your domain is authenticated end to end.
Keys and access
- API keys are shown once, at creation. We store only a keyed hash, so a copy of our database does not yield a working key.
- Keys carry scopes and can be revoked instantly from the dashboard. Revocation takes effect on the next request.
- Requests are rate limited per key and per account.
- Passwords are hashed with a modern, salted algorithm and never logged.
- Payment details never touch our servers. Stripe collects and stores them.
Data in motion and at rest
- Every connection to the API and the dashboard is over HTTPS. Plain HTTP is refused.
- Databases, object storage, and backups are encrypted at rest by the providers that host them.
- Message content is stored only for as long as it's needed to deliver and to show you the receipt, then deleted on the schedule below.
- We do not read your messages except to resolve a support request you've opened, and we never use them to train models.
Retention
| What | Kept for |
|---|---|
| Message bodies and attachments | 30 days, then permanently deleted |
| Delivery metadata and logs | 365 days, for receipts and troubleshooting |
| Account data after closure | 30 days, then deleted |
| Payment records | 7 years, as tax law requires |
You can request deletion of your data at any time from the dashboard or by writing to support@transmit.dev.
Reporting a problem
If you find a security issue, write to support@transmit.dev with "SECURITY" in the subject line. We read those first.
- Good-faith research is welcome. We will not pursue legal action against responsible disclosure.
- Give us a reasonable window to fix the issue before publishing it.
- We'll credit you in our acknowledgments if you'd like.