Pipeline notePlatform-domain onboarding now publishes DMARC in monitoring mode by default.Read the record

Reviewed each release

Privacy

What Mailhaven stores

Account details (name, business name, email address and a bcrypt hash of your password), the connection settings for your sending domain, and the mail delivered to the addresses you create. Mail is stored so that you can read it: headers, bodies, attachments and the raw provider payload of each delivery.

Provider credentials

Resend API keys and webhook signing secrets are encrypted at rest with AES-256-GCM using a per-record salt and initialisation vector. They are decrypted only in the request that needs them — verifying your connection, sending a message or validating an inbound signature — and are never returned to the browser or written to logs.

Who can see your mail

Only you. Every query in the product is scoped to a single account id. The operator console shows connection status, delivery outcomes, job state and usage counters; it has no view onto message bodies or attachments.

Retention of raw payloads

The raw provider payload for each inbound delivery is archived so a failed content fetch can be retried without losing the message. The retention window is an operator setting and defaults to thirty days.

Deleting your data

Deleting a message moves it to Trash, where you can restore it or remove it permanently. Closing an account removes its addresses, messages, attachments, delivery records and stored credentials.