Security

There is no outbound mail server in our infrastructure — not disabled, not restricted: absent. MailFixture cannot send email, so a compromise of our systems can't spoof your domain, spam your users, or phish anyone. The best attack surface is the one that doesn't exist.

Inboxes expire by TTL; messages age out per your plan's retention (3–30 days) and are then hard-deleted — rows and blobs, not flags. Deleting an inbox deletes its messages immediately. We keep aggregate counts for billing; the email itself is designed to be short-lived.

TLS 1.2+ on every API and dashboard connection. Inbound SMTP offers STARTTLS (TLS 1.2+, auto-renewed certificates) — though SMTP being SMTP, encryption on that hop is the sending server's choice; every major provider takes it. API keys are stored hashed (argon2id) — which is why we can only show yours once.

The dashboard renders email HTML in a sandboxed frame: no scripts execute, remote images are blocked outright by CSP, tracking pixels never phone home. The email your test received can't touch the dashboard your team is signed into.