Email Encryption & Security: Protecting Data at Every Layer

Email platforms handle your most sensitive data: customer lists, personal information, behavioral tracking, campaign content. A breach exposes not just your data, but your customers' data. Enterprise-grade encryption isn't optional—it's foundational.

DoPosta implements **defense-in-depth encryption**: AES-256-GCM for API traffic, AES-256-CBC for file storage, TLS 1.3 for database connections, field-level encryption for sensitive data, plus comprehensive security headers and monitoring.

The Threat Landscape

Email marketing platforms are high-value targets for attackers:

**Contact list theft**: 10 million email addresses with engagement data sells for $50,000+ on dark web markets. Lists are often more valuable than credit card data (which expires quickly).

**Campaign hijacking**: Attackers modify campaigns to insert phishing links or malware. Your brand sends malicious emails to your own customers. Reputational damage is irreversible.

**API key compromise**: Exposed API keys allow attackers to send unlimited emails from your infrastructure, burning your IP reputation and potentially landing you on blacklists.

**Credentials in transit**: Unencrypted SMTP credentials intercepted during transmission give attackers direct server access.

**Database breaches**: If an attacker gains database access, unencrypted fields (emails, names, custom data) are immediately compromised.

DoPosta's encryption strategy mitigates every attack vector.

Encryption at Rest

All data stored in DoPosta's databases and file systems is encrypted:

Database Encryption (AES-256-CBC)

**Full disk encryption** on all database servers using AES-256-CBC. If physical drives are stolen or server is decommissioned, data is cryptographically unreadable.

**Field-level encryption** for highest-sensitivity data:

Field encryption uses **envelope encryption**: Each field is encrypted with a data encryption key (DEK), and DEKs are encrypted with a master key encryption key (KEK) stored in a hardware security module (HSM).

**Key rotation**: Master keys rotate every 90 days. Old encrypted data is re-encrypted with new keys in a background process. Zero downtime, complete compliance.

File Storage Encryption (AES-256-GCM)

Uploaded assets (images, HTML templates, CSV imports, exports) are encrypted in object storage (S3, R2, Azure Blob):

When you upload a template image, it's encrypted before touching storage. When displayed in the email builder, it's decrypted on-demand with time-limited access tokens.

Backup Encryption

Daily backups are encrypted separately from production data:

Encryption in Transit

Data moving between systems must be protected from interception:

API Traffic (TLS 1.3)

All API requests to DoPosta use **TLS 1.3** (or TLS 1.2 minimum for older clients):

Try connecting to DoPosta's API with HTTP: curl http://api.doposta.com/v1/campaigns. Immediate 301 redirect to HTTPS with HSTS header: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload.

Database Connections (TLS 1.2)

Application servers connect to databases over **encrypted TLS connections**:

Email Transmission (TLS 1.2/1.3)

Outbound emails from DoPosta to recipient servers use **opportunistic TLS**:

When sending to Gmail, Outlook, Yahoo: TLS 1.3 with AES-256-GCM is negotiated. Delivery logs show encryption status per recipient domain.

SMTP Credential Protection

PowerMTA configuration files contain SMTP credentials. DoPosta encrypts these:

API Security

DoPosta's REST API implements multiple security layers beyond encryption:

Authentication (JWT with RS256)

API authentication uses **JSON Web Tokens (JWT)** signed with RSA-256:

Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

Token payload includes user ID, workspace ID, role, and allowed permissions. Tampering with payload invalidates the signature.

Rate Limiting

Prevent brute force and abuse:

Exceed limits and receive 429 Too Many Requests with Retry-After header.

Request Signing (HMAC-SHA256)

For maximum security, enable **request signing** on API keys:

Each request includes a signature generated with HMAC-SHA256:

X-DoPosta-Signature: sha256=3a5d2f8b...

Server recalculates signature using shared secret. Mismatched signatures are rejected. Prevents request tampering and replay attacks.

IP Whitelisting

Restrict API key usage to specific IP addresses:

API calls from non-whitelisted IPs are rejected with 403 Forbidden.

Web Application Security

DoPosta's web dashboard implements comprehensive security headers:

Content Security Policy (CSP)

Prevent XSS attacks with strict CSP:

Content-Security-Policy: default-src 'self'; script-src 'self' 'sha256-xyz'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://api.doposta.com;

Additional Security Headers

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

X-Frame-Options: DENY

X-Content-Type-Options: nosniff

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy: geolocation=(), microphone=(), camera=()

CSRF Protection

All state-changing requests require CSRF tokens:

XSS Prevention

Multiple layers prevent cross-site scripting:

Compliance & Certifications

DoPosta's encryption and security practices meet:

SOC 2 Type II

Independent audit of security controls including encryption at rest, encryption in transit, key management, access controls, and incident response. Annual re-certification.

GDPR (General Data Protection Regulation)

Right to erasure (data deletion including encrypted backups), data portability (encrypted exports), breach notification (within 72 hours), data processing agreements, and EU data residency options.

HIPAA (for healthcare customers)

Business Associate Agreements (BAA) available, encrypted PHI (Protected Health Information), audit logging, access controls, and breach notification procedures.

PCI DSS (Payment Card Industry)

Credit card data never stored unencrypted. Payment processing via PCI-compliant providers (Stripe). Encrypted transmission of payment data.

Key Management

Encryption is only as strong as key management:

Hardware Security Modules (HSM)

Master encryption keys stored in **FIPS 140-2 Level 3** hardware security modules:

Key Hierarchy

DoPosta uses a multi-tier key hierarchy:

1. **Root key** - Stored in HSM, never rotates, only encrypts KEKs

2. **Key Encryption Keys (KEK)** - Rotate every 90 days, encrypt DEKs

3. **Data Encryption Keys (DEK)** - Unique per customer, encrypt actual data

Rotating a KEK re-encrypts all DEKs but doesn't require re-encrypting customer data (only DEKs need re-encryption).

Key Rotation Schedule

Monitoring & Incident Response

Security monitoring runs 24/7:

Security Monitoring

Incident Response Plan

If a security incident occurs:

1. **Detection** (Target: <5 minutes) - Automated alerts to security team

2. **Containment** (Target: <15 minutes) - Isolate affected systems, rotate keys

3. **Investigation** (Target: <2 hours) - Determine scope and root cause

4. **Remediation** (Target: <24 hours) - Patch vulnerabilities, restore service

5. **Notification** (Target: <72 hours) - Inform affected customers if data exposed

Customer notification includes: What happened, what data was affected, what we're doing, what you should do, and dedicated support contact.

Best Practices for Customers

DoPosta encrypts platform data, but you control campaign security:

API Key Security

Password Management

Email Content Security

Encryption Performance Impact

Strong encryption comes with computation cost. DoPosta's optimizations:

Result: Encryption adds <5ms latency to API requests, imperceptible to users.

Conclusion

Email platform security requires comprehensive encryption: AES-256 for data at rest, TLS 1.3 for data in transit, field-level encryption for sensitive fields, secure key management in HSMs, and defense-in-depth with security headers, rate limiting, and monitoring.

DoPosta's encryption architecture meets SOC 2, GDPR, HIPAA, and PCI standards. Your data is protected at every layer.

Ready to secure your email infrastructure? [Start your DoPosta trial](/register) with enterprise-grade encryption enabled by default.

[View security documentation](/features) or [request a security audit report](/contact) for compliance reviews.