This page lists the measures SendNeo has in place today. It is not a certification; we hold none, and we will say so here when that changes.
Data in transit and at rest
- Every page, API call and webhook to SendNeo uses HTTPS (TLS), with HSTS on the site.
- Message bodies are deleted 30 days after sending and message records after 90 days.
- The production database is backed up every hour; backups are encrypted and copied off site.
Keys and sign-in
- API keys are shown once, when you create them. We store only a peppered HMAC-SHA256 hash, so a copy of our database cannot be turned back into working keys. Keys can be revoked at any time and carry a scope (full, sending-only, agent).
- Passwords are hashed with scrypt. New accounts confirm their email address with a one-time code before the dashboard opens.
- Sessions use HTTP-only, secure, same-site cookies; the server stores only a hash of the session token. Every form in the dashboard carries a CSRF token.
- AI agents connect through OAuth 2.1 with PKCE (S256) and short-lived access tokens with rotating refresh tokens, or through a scoped agent key. Every connection is listed in the dashboard and can be revoked on its own.
Webhooks
- Every webhook request is signed with HMAC-SHA256 over a timestamp and the body (
SendNeo-Signature: t=…,v1=…), with a per-endpoint secret shown once. - SendNeo only delivers webhooks to
https://endpoints on public addresses, so a webhook cannot be pointed at an internal network. - Delivery notifications from Amazon SNS are accepted only with a valid AWS signature from the expected topic.
Sending isolation and abuse controls
- Each SendNeo account sends through its own Amazon SES tenant, so one sender's reputation problems can be contained without touching anyone else.
- A person reviews every new account before it can send to outside recipients.
- Rate limits protect sign-in, sign-up, password reset, the API (10 requests a second per key) and public endpoints.
- Bounced and complaining addresses are suppressed automatically, and accounts whose bounce or complaint rates spike are paused for review.
- Content shown on our own pages from customer input is sanitised, and the site sends a strict Content-Security-Policy.
Operations
- Admin actions — approving, pausing or changing an account, kill switches, keys created and revoked — are written to an audit log.
- Credentials for other platforms that you paste into the migration tool are encrypted (Fernet) while the import runs and deleted when it ends, or after an hour if it never starts.
Reporting a vulnerability
Please email hello@yorkermedia.com with the details and a way to reproduce the issue. We read every report, will keep you updated while we fix it, and ask that you give us a reasonable time to fix it before going public. Please don't access other people's data, degrade the service or send spam while testing.