Security at Mailfois
Email teams trust us with plans, unreleased campaigns and their clients’ approvals. Here’s plainly how we protect them, and what’s still on the way.
What Mailfois never holds
Mailfois is where emails are planned, checked and approved, not where they’re sent. So it never needs your customers’ details:
- No subscriber or customer lists, and no customer email addresses.
- No connection to your email platform, and no log-in to it. Emails come in as a preview link or HTML.
- No sends to your customers. Mailfois never sends your campaigns, and test emails go only to the person signed in.
- No raw customer replies. If you add replies to see what customers said, email addresses, phone numbers, postcodes, order numbers and the names in greetings and sign-offs are stripped out in your browser before anything is saved.
- Results as totals only: opens, clicks and revenue per email, never per person.
That’s why agencies can check and approve their clients’ emails in Mailfois without ever holding their clients’ customer data. Each workspace can print a one-page letter saying exactly this, with who can see it and how sign-off works.
Your data stays in the UK
Your workspace data is stored in our database provider’s London region. The app runs on Cloudflare’s network. Every company that handles data for us, and why, is listed in Annex 3 of our data processing agreement, and we tell workspace owners 30 days before that list changes.
Encrypted in transit and at rest
Every connection to Mailfois is encrypted with TLS, and browsers are told to use HTTPS only (HSTS). Data is encrypted at rest by our hosting and database providers, and the database is backed up daily.
Access is enforced by the database
Every table uses row-level security, so people can only read and change data in workspaces they belong to. That rule lives in the database itself, not just in the app. Owners and admins decide who’s in a workspace, their role, and which areas each person can see. Agency clients each have their own separate workspace.
Approval links that can’t be stolen from us
- Each private approval link carries a random code with 256 bits of randomness.
- We store only a one-way hash of it, so links can’t be recovered from our database.
- Links expire, can be switched off or replaced at any time, and have a “This isn’t me” button that switches the link off and alerts your team.
- Before a link is sent, we confirm the address and flag any domain your other approvers don’t use.
Accounts and sign-in
Anyone can turn on two-factor sign-in with an authenticator app, with a backup device if they like, and workspace owners can require it for everyone. That requirement is held in the database too: without it, a workspace’s data can’t be read at all. Owners can also limit which email domains can be invited. Passwords are stored hashed by our authentication provider, never by us in plain text. Sign-in sessions use secure, HTTP-only cookies, and you can choose not to stay signed in on a shared computer.
A record of who changed what
Owners and admins can see the workspace’s activity: people joining, leaving or changing role, invites, who can see which areas, sign-in and security rules, other settings, plan changes and data exports, with a CSV download. It also shows when each person last signed in. Approvals and campaign changes have their own full history.
Locked-down code and pages
Pages only run Mailfois’s own scripts (a content security policy with a one-time code per page), and the database functions that aren’t part of a private approval or translator link can’t be called by anyone who isn’t signed in. Scheduled jobs, such as reminders, run only with our server key.
Payments
Payments are handled by Stripe. Card details go straight to Stripe and never touch our servers.
Tools that stay in your browser
The free pre-send tools and the image tool work in your browser. Your content isn’t uploaded unless you choose a feature that needs it, such as AI alt text, which is off until you ask for it on a particular image.
Least privilege
Server keys are kept as encrypted secrets with our hosting provider, never in source code or the browser. Only the people who run Mailfois can access production systems.
Your data, your call
Owners and admins can export everything in a workspace at any time, including a download link for every document. When a workspace is closed, its data is deleted within 30 days. If we ever decided to stop running Mailfois, every workspace owner would get at least 90 days’ notice to export everything (see our terms). Our data processing agreement is available to every customer, and we’ll sign a copy on request.
Our email is authenticated too
mailfois.com publishes SPF, DKIM and DMARC records, so mailbox providers can tell genuine Mailfois email from fakes.
On the way
- Sign in with Microsoft or Google, and a workspace rule that requires it, so your IT team’s leaver process applies. Built and being switched on.
- Single sign-on (SAML), for example through Okta or Entra ID, set up on request.
- The Cyber Essentials certificate.
- An independent penetration test.
If you need any of these to get started, tell us what you need.
Found a security issue?
Please email [email protected]. We’ll acknowledge it within two working days, keep you updated while we fix it, and credit you if you’d like. Please give us a reasonable time to fix an issue before sharing it, and don’t access other people’s data or disrupt the service while testing. Our security.txt has the same details.