Security

Accounts use password or OAuth sign-in (Google, GitHub). Passwords are stored as strong hashes and never in plain text. Two-factor authentication (TOTP) can be enabled per account. All active sessions are listed in the settings and can be revoked individually or all at once, which is useful if a device is lost or compromised.

Workspaces support multiple members with owner, admin, and member roles. API keys are scoped and can be revoked. Sensitive account actions require the account password or a 2FA code where enabled.

Traffic between your browser and the service is encrypted with TLS in production deployments. Emails are sent through Resend using a dedicated API key per deployment. Tracking links in outgoing mail are signed so they cannot be forged. We never expose secrets, tokens, or API keys in the client, and we do not sell or share your data.

The hosted service is deployed behind a managed platform (Render) which handles TLS and network isolation. Delivery webhooks from Resend can be verified with a signing secret. Contact import and export are available over the API using your authenticated session.

No system is perfectly secure. You can reduce risk by enabling two-factor authentication, using strong unique passwords, reviewing active sessions, and keeping your own deployment's operating system and configuration up to date.

If you find a security issue, please report it privately to hello@mailgeko.dev rather than in a public forum. We appreciate responsible disclosure.