Your data, protected at every step
MailNesto is built with security and privacy in mind — for your team, your subscribers and your reputation as a sender.
Controls your security team will like
Encrypted secrets
Passwords are hashed; API credentials, SMTP passwords and store tokens are encrypted at rest and never shown again.
Two-step verification
Authenticator-app codes with recovery codes, available to every user.
Single sign-on
SAML, Google and Microsoft sign-in with domain verification, just-in-time accounts and optional enforcement.
Roles and permissions
Owner, admin, marketer, analyst and developer roles, plus custom roles that allow exactly what each person needs.
Audit log
Every important change — who, what and when, from which address — kept for your review.
Session control
See signed-in devices and sign them out remotely; sessions end automatically after inactivity.
Scoped API keys
Read-only or full keys, IP allow-lists, usage per key, and automatic alerts on unusual traffic.
Backups
Nightly database backups, kept for a week, with optional copies to S3-compatible storage.
Privacy by design
Consent records, double opt-in, data access and deletion requests, and a subscriber preference centre.
Email the way the law expects
Tools that help you meet anti-spam rules and privacy laws such as India’s DPDP Act and the GDPR.
- One-click unsubscribe in every marketing email (RFC 8058), honoured instantly
- Your postal address in every footer
- Proof of consent: when, where and how each person subscribed
- Data requests (access, correction, deletion) tracked with deadlines
- Suppression lists shared across campaigns and automations
How we protect your account and your subscribers
Email marketing data is personal data: names, addresses, what people bought and which emails they opened. This section describes the specific controls MailNesto uses to protect that data and your account, and the tools it gives you to meet your own duties to subscribers. Everything listed here is a feature you can see and use in the product.
Security is shared work. The platform handles how passwords, keys and secrets are stored, how sign-in is protected and how sending is policed across all accounts. You decide who joins your workspace, what each person may do, which addresses your API keys accept and how long you keep contact data. The sections below cover both sides.
Who can get in, and what they can do
Passwords are stored only as bcrypt hashes, never as readable text, and the platform can require a minimum length, particular character types and no reuse of recent passwords. Repeated wrong attempts lock sign-in for a short time. Two-step verification works with any authenticator app, such as Google Authenticator, 1Password or Authy. Recovery codes are shown once and stored hashed, and you can trust a device for 30 days so you are not asked for a code on every visit.
Organisations that manage staff accounts centrally can use SAML, Google or Microsoft single sign-on. Once your email domain is verified, SSO can be enforced so your team can no longer sign in with a password. Your Security page shows a security score, every signed-in device with its last activity, and recent sign-ins with the method, IP address and country. You can sign out any device remotely; changing your password signs out the others, and changes to your password or two-step settings send you an alert.
Inside a workspace, built-in roles (owner, admin, marketer, analyst, developer) and custom roles decide who can view or edit each area. Sending setup, team, billing and workspace settings can only be changed by owners and admins.
- Audit log of important changes: who, what, when and from which IP address
- Passwords, tokens and keys in logged requests are replaced with “hidden”
- Of the built-in roles, only owners and admins can open the audit log and privacy requests
- Agency client workspaces can require approval before a campaign is sent
Secrets stored so they can’t be read back
Credentials you give MailNesto — SMTP passwords, sending-service keys, store tokens and payment-gateway secrets — are encrypted at rest with AES-256-GCM. The encryption key can be rotated: data stays readable while stored secrets are moved to the new key. Webhook signing secrets are encrypted the same way.
API keys are handled differently because nobody needs to read them again: the full key is shown once when it is created, and only a one-way hash and a short prefix are kept. Session cookies are HTTP-only, so scripts on a page can’t read them. Branded tracking domains such as links.yourbrand.com get HTTPS certificates automatically, and the database is backed up every night so it can be restored after a failure.
Keys and webhooks with limits you set
Each API key is either read-only or full access. Even a full-access key can’t change team members, billing, workspace settings or sending setup, and it can’t create other keys. Keys can be tied to a list of IP addresses or ranges, so a leaked key is useless from anywhere else, and the key list shows when each one was last used. API traffic is watched for unusual patterns — sudden spikes or runs of refused requests — and flagged to the platform team.
Webhooks are signed with HMAC-SHA256 using a secret per endpoint, with a timestamp in the signature so your server can reject replayed requests. Secrets can be rotated at any time. Webhook addresses that point at private or internal networks are refused, which stops a webhook being used to probe systems behind the platform.
Proof of how every person subscribed
Lists can use double opt-in, so a new subscriber confirms by email before receiving anything. Every change of consent — given, withdrawn, updated or erased — is written to a consent log with its source and the proof available, such as the form used or the team member who made the change. The log can be searched and filtered when someone asks how they came to be on your list.
Public sign-up forms are protected from bots by an invisible check that every submission must solve in the browser, and you can add a CAPTCHA (Cloudflare Turnstile, hCaptcha or Google reCAPTCHA) with your own keys. That keeps fake sign-ups, which often turn into bounces and spam traps, off your list.
Data requests, retention and leaving
Requests to access, correct, delete, port or object to the use of someone’s data are tracked from receipt to completion, with a 30-day due date and a law tag (DPDP, GDPR, CCPA or other). You can export everything held about one contact, or erase them while keeping their address suppressed so they aren’t re-added by a later import. The preference centre can let subscribers download a copy of their data themselves, or ask for deletion, which opens a verified request for your team.
A retention rule can delete contacts with no opens, clicks, visits or orders for a set number of months (3 to 120), and remove old activity history after a set period. A preview shows how many records a rule would remove before you save it. If you decide to leave, the account owner can ask for the account to be closed from Settings; the request can be cancelled until the platform team deletes the account and its data.
Protecting everyone’s sending reputation
On a shared platform, one careless sender can hurt everyone’s delivery, so sending is policed for all accounts. Bounces and complaints are read from bounce and feedback-loop mailboxes and matched to the account that sent the email, then suppressed. Some new sign-ups are reviewed before they can send, and campaigns containing phrases on the platform’s review list are held until a person checks them.
Anyone can block their address for every sender on MailNesto through the “Stop emails to my address” page, and that block is honoured by marketing and transactional email alike. Transactional messages skip marketing unsubscribes, because a receipt is not marketing, but never go to a suppressed or blocked address.
Security and privacy questions
What does the security score on my account measure?
Five things, weighted by how much they matter: two-step verification switched on, a password changed in the last 180 days, enough recovery codes left, five or fewer signed-in devices, and no failed sign-ins in the past week. Each item has a fix button.
Can my company force everyone to use single sign-on?
Yes. Set up a SAML, Google or Microsoft connection, verify your email domain, and turn on enforcement. Team members on that domain then sign in through your identity provider, and password sign-in is blocked for them.
What happens if an API key leaks?
Revoke it under Developers → API keys; it stops working on the next request. To limit the damage in advance, give each system its own key, use read-only keys where nothing needs changing, and restrict keys to your servers’ IP addresses.
Can I see who changed something in our account?
Owners and admins can open the audit log, which lists important changes with the person or API key responsible, the time and the IP address. Sensitive values such as passwords and tokens are hidden in the log.
Does deleting a contact remove them completely?
There are two options. A normal delete removes the contact. “Forget me” erases their details and activity but keeps the email address on your suppression list, so they can’t be emailed again or re-added by an import.
Are our sign-up forms protected from bots?
Yes. Every public form uses an invisible proof-of-work check that bots posting directly to the form must also solve, and each token works only once. You can add Cloudflare Turnstile, hCaptcha or reCAPTCHA with your own keys for extra protection.
What happens to our data when we close the account?
The owner requests closure from Settings by typing the workspace name to confirm. Auto-renew stops, and the platform team deletes the account and its data once any billing is settled. Export your contacts and reports first if you need them.
Found a security issue?
Please tell us privately so we can fix it quickly. We reply to every report.