Security

#Reporting a vulnerability

Email security@pidgely.com with a description, the steps to reproduce and the impact you expect. Please:

• give us a reasonable time to fix the issue before disclosing it;
• don't access, modify or delete data that isn't yours, and stop as soon as you reach someone else's data;
• don't degrade the service (no denial of service, no spam, no social engineering of our team).

We acknowledge reports quickly, keep you informed, and credit researchers who want it. Our contact is also published in /.well-known/security.txt.

#How your data is protected

• API keys are shown once and stored only as HMAC digests; revoked keys stop working within about 30 seconds.
• Secrets at rest: DKIM private keys and webhook signing secrets are encrypted with AES-256-GCM.
• Transport: the API is HTTPS only; SMTP submission requires TLS 1.2 or newer; outgoing mail uses TLS whenever the receiving server supports it, or always with tls: enforced.
• Webhooks are signed (HMAC-SHA256, Standard Webhooks) and only delivered to public https endpoints; private and internal addresses are refused.
• Remote attachments are fetched through the same SSRF guard, without following redirects.
• Abuse controls: sandboxed new accounts, quotas, executable attachments blocked, header injection rejected, automatic pause on abnormal bounce or complaint rates.

#Your side

• Keep API keys on the server and in a secret manager; prefer domain-restricted sending keys.
• Always verify webhook signatures and check timestamps.
• Publish DMARC for your domains to stop others from spoofing them.