security
What we can show you.
The mechanisms that protect your account, stated plainly. If it isn’t on this page, don’t assume we do it; ask.
- Account isolation Live
- Every table that holds customer data is protected by row-level security in the database. A request can only read or write rows belonging to the account it’s acting for, even if application code gets it wrong.
- Sign-in Live
- Sessions use short-lived tokens signed with RS256, and refresh tokens that rotate each time they’re used.
- Roles Live
- Owner, marketer, analyst and developer. You can only give someone permissions you hold yourself.
- API keys Live
- Stored as argon2id hashes, shown to you once. Each key has scopes and an optional expiry, and can be revoked.
- Webhooks Live
- Every delivery is signed with HMAC-SHA256 over a timestamp and the body, so you can check it came from us and wasn’t replayed.
- Tracking and unsubscribe links Live
- Signed, so they can’t be altered to point somewhere else or to unsubscribe someone else.
- Activity log Live
- Changes to your account are recorded in an activity log you can read.
Not yet
Worth knowing before you ask for a questionnaire.
- Not yetTwo-factor sign-in
- Not yetSingle sign-on (SAML, OIDC)
- Not yetCertifications
- We don’t hold SOC 2, ISO 27001 or similar. This page will say so when that changes.
Found something?
Write to hello@meereach.com with “Security” in the subject. A person reads it.