Security

This page explains how PennyPost protects your data and your users' data. It's also Annex 2 of our Data Processing Addendum, so what it says is part of our commitments to customers.

PennyPost doesn't hold a SOC 2 or ISO 27001 certification. If you're running a security review, email hello@usepennypost.com and we'll answer your questionnaire.

Where PennyPost runs

• The app, the API and the snippet's endpoint run on Vercel.
• Our database is MongoDB Atlas, on Amazon Web Services in the US East (N. Virginia) region.
• Email goes out through Amazon SES in the same region, or through your own Resend account if you connect one.
• Background jobs run on Upstash QStash, and rate-limit counters on Upstash Redis.

The full list, with what each provider handles, is on our Subprocessors page.

Encryption

In transit. PennyPost serves its pages and APIs over HTTPS only, and every response tells browsers to use nothing but HTTPS with us for two years (HSTS). Our servers reach the database over TLS and call every other provider over HTTPS.

At rest. MongoDB Atlas encrypts the database's storage. On top of that, we encrypt the most sensitive secrets ourselves with AES-256-GCM before we store them: Resend API keys, Resend webhook secrets, and identity secrets you've rotated. Each encrypted value is tied to its workspace or app, so a copy moved to another one won't open.

Passwords, keys and tokens

• Passwords are stored as scrypt hashes, each with its own random salt, so we can't read them. Changing your password signs out every other device. You can also sign in with Google.
• API keys are shown once, when you create them. We store only a SHA-256 hash and a short prefix that helps you tell keys apart. You can revoke a key at any time.
• PostHog and Segment ingest tokens can only post events to one app's connection for that one tool, and can't read anything. We store only a SHA-256 hash. "New token" keeps the old one working for 24 hours, so you can update the destination without a gap.
• One-click PostHog gets a read-only token for the one project you picked. We encrypt its access and refresh tokens before storing them, and you can disconnect in PennyPost or PostHog.
• AI assistants you allow through our MCP server (ChatGPT, Claude and others) get a read-only token for one workspace. Sign-in uses OAuth with PKCE. Access tokens last an hour, refresh tokens 90 days and change on every use, and we store only SHA-256 hashes. Disconnect one on the API keys page and its tokens stop working at once.
• Identity secrets. The snippet runs in your users' browsers, where nothing is secret. So your server signs each user's email address with your app's identity secret (HMAC-SHA256), and we refuse snippet data without a valid signature. That stops anyone from sending page views or adding contacts in someone else's name. You can rotate the secret whenever you like, and the old one keeps working for 24 hours.
• Password reset links are stored as hashes and stop working once used or expired.
• Links in emails. Unsubscribe, confirmation, open and click links are signed, so they can't be forged, and click links can't be used to send people to sites the email didn't link to.

Access

• Every dashboard page and API route checks for a valid login session or API key.
• Login sessions last 7 days, in a signed cookie that scripts can't read and that's only sent over HTTPS.
• Each customer's data belongs to a workspace, and the app's queries only reach the signed-in customer's workspace.
• Only the people who run PennyPost can open the admin area. We look at customer data only to run PennyPost, to help when you ask, or to look into abuse or a security problem.
• Logins, signups, password resets, public forms and the APIs are rate-limited.

Keeping data small

• The snippet sends page paths, never query strings or anything after a #.
• We don't store IP addresses or browser details with page views, key actions, opens or clicks.
• The details sent with a key action are capped at 2 KB.
• Page views and key actions are deleted after 180 days, and so are the records of each email sent.
• For visitors in the EU and the UK, the snippet can wait for consent before it sends or stores anything. Add data-consent="required" to its script tag and call pennypost("consent", true) or pennypost("consent", false) with your banner's answer.
• Open and click tracking can be turned off for each app in Setup.

Webhooks and background jobs

• We accept Amazon SES delivery events only when AWS SNS signed them for our own topic.
• Background jobs run only when Upstash QStash signed the request.
• Resend events are checked against your workspace's webhook signing secret, and Polar billing events against ours.
• PostHog and Segment deliveries need the connection's ingest token.

Sending

A workspace can only send from domains it has verified, and each workspace's sending reputation is kept apart from every other customer's. Every hard bounce and spam complaint puts the address on our suppression list straight away. The Acceptable use policy has the limits that pause sending.

Security incidents

If we become aware of a security incident that affects data we process for you, we'll email your account's address without undue delay, and within 48 hours. We'll say what happened, what data and roughly how many people it affects, what we're doing about it, and who to talk to, and we'll send more as we learn it. If it affects your own account data, we'll also tell the relevant authorities as the law requires. Section 9 of the Data Processing Addendum has the full commitment.

Reporting a vulnerability

If you think you've found a security problem in PennyPost, email hello@usepennypost.com with "Security" in the subject. Tell us what you found, how to reproduce it, and what someone could do with it. We read every report and will tell you what we're doing about it.

While you look, please:

• only use accounts you own, and don't access, change or delete other people's data;
• don't send email to people who didn't ask for it, and don't run tests that slow PennyPost down for others, such as load or denial-of-service tests;
• give us a reasonable time to fix the problem before you tell anyone else.

We don't pay bug bounties. If you act in good faith and follow these rules, we won't take legal action against you.

Contact

[LEGAL NAME]
[POSTAL ADDRESS]
hello@usepennypost.com