Security
What we can show, and what we cannot.
MAILTIG isolates tenants and encrypts mailbox secrets. It has not completed SOC 2, ISO 27001 or an independent penetration test. The table below lists each control and whether it has an independent audit.
Last reviewed: 4 November 2026 · product repository probes
MAILTIG has not completed SOC 2, ISO 27001 or an independent penetration test. Privacy, terms and cookie notices are published on this site. Campaign email includes List-Unsubscribe headers and a postal-address footer you configure.
Controls
Verified in the product repository.
- Sign-in
- Workspace users enter their workspace code, then sign in on a separate secure sign-in page (OpenIddict, authorization code with PKCE). Passwords are never entered in the application itself. Accounts lock for five minutes after five failed attempts.
- Tenant boundaries
- Every workspace is a separate tenant. An automated cross-tenant probe confirmed that reading, changing or deleting another workspace's records is denied, and an anonymous sweep of all API operations found none exposed.
- Headers and secrets
- Security headers (CSP, frame options, referrer, permissions, content-type) on the API and the application; mailbox passwords, OAuth tokens and integration keys are stored encrypted.
| Control | Evidence | Independent audit |
|---|---|---|
| Tenant isolation | Automated cross-tenant probe, all denied (2026-11-04) | No |
| Anonymous API exposure | 343 operations swept, 0 exposed, 8 public by design | No |
| Authentication | Workspace code, then OpenIddict authorization code + PKCE on a separate host | No |
| Account lockout | Five failed attempts, five minutes | No |
| Encryption at rest (secrets) | Mailbox passwords, OAuth tokens and integration keys stored encrypted | No |
| Security headers | CSP, frame options, referrer, permissions, nosniff on API and SPA | No |
| SOC 2 / ISO 27001 | Not obtained | No |
| Independent penetration test | Not commissioned | No |
Contact the security team
Report a vulnerability.
How to reach us
Email info@mailtig.com with intent “security”. Do not send customer data or exploit payloads to this marketing origin. There is no public bug bounty yet.