How we protect your account and your data.
All connections to MailboxRadar are encrypted with TLS 1.2 or higher. We enforce HTTPS on every page and use HTTP Strict Transport Security (HSTS) to prevent downgrade attacks.
Passwords are hashed with bcrypt before storage. We never store or transmit your password in plain text. We enforce a minimum length of 8 characters at registration.
You can protect your account with time-based one-time password (TOTP) two-factor authentication or SMS one-time codes. We strongly recommend enabling 2FA on all accounts.
Payments are processed by Stripe, a PCI DSS Level 1 certified provider. We never see or store your full card number — only the last four digits and card type.
Sensitive settings (API keys, tokens) stored in our database are encrypted with AES-256 before being written to disk.
Our servers run on hardened Linux with automated security patches applied regularly. Access is restricted to named team members over SSH with key-based authentication. We do not use shared passwords.
Login, registration, and password-reset endpoints are rate-limited. Registration includes a honeypot trap to block automated signups.
If you discover a security vulnerability, please email security@mailboxradar.com. We aim to acknowledge reports within 48 hours and resolve critical issues within 7 days. Please do not disclose the issue publicly until we have had a chance to address it.
We conduct periodic security reviews of our codebase and infrastructure. If you have questions about our security posture, contact hello@mailboxradar.com.