Security & Trust
Last updated: September 25, 2026
Zero AI Model Training
Your email HTML, templates, and prompts processed via AI Fix and AI Builder are never used to train foundation models.
PCI-DSS Level 1 Payments
All transactions run through Polar.sh and Stripe. Payment card details never touch or pass through Emailens servers.
Ephemeral by Default
Unsaved previews process in-memory. Authenticated previews and screenshots auto-expire and purge after 30 days.
Encryption in Transit & Rest
Marketing and API traffic use HTTPS with modern TLS. PostgreSQL (Supabase) and Cloudflare R2 object storage are encrypted at rest with AES-256.
GDPR & Data Rights
Instant JSON account export and one-click account deletion. Standard Data Processing Addendum (DPA) available.
Open Source Engine
Our core CSS compatibility matrix and parser are public code. Anyone can audit our rendering rules and sanitization.
Our Security Philosophy
Email developers trust Emailens with pre-release transactional templates, product launch announcements, and critical design assets. Instead of burying our security practices behind opaque marketing claims or paid audit logos, we believe in radical technical transparency: providing clear, verifiable information on how your data moves through our infrastructure, where it is stored, and when it is destroyed.
Where Emailens is hosted
The marketing site (emailens.dev) is served from Cloudflare Pages with Cloudflare CDN and TLS at the edge.
The web application and API (app.emailens.dev) run in Docker containers on a Hostinger KVM virtual server in Europe, managed with self-hosted Coolify.
Cloudflare (marketing and edge) and Hostinger (application server) may process standard request logs including IP addresses, user agents, and timestamps.
Generative AI & Zero Model Training Guarantee
Emailens offers optional AI-powered features, including AI Fix (which automatically patches unsupported CSS properties for target email clients) and the AI Builder (natural language template scaffolding and styling).
Anthropic Commercial API Terms
All AI requests are routed directly to Anthropic's commercial Claude API. Under Anthropic's commercial agreements, no customer inputs (prompts, HTML, or CSS) or generated outputs are ever used to train Anthropic's AI or machine learning models. Your proprietary template markup and email designs remain exclusively yours.
Inputs sent to AI endpoints are processed in-flight. We do not maintain any secondary vector databases, fine-tuning corpora, or offline training datasets of user emails.
Data Lifecycle & Ephemeral Previews
Emailens is built around a principle of data minimization: we store only what is strictly necessary to provide you with preview results and account functionality.
- Unauthenticated Previews: Processed in-memory on our application servers (Docker on Hostinger, orchestrated by Coolify). Raw HTML is parsed against our CSS compatibility matrix, rendered, and discarded after the HTTP response completes when you do not save a preview. No preview record is written to PostgreSQL unless you sign in and persist results.
- Authenticated Previews & Screenshots: When signed in, preview records and high-resolution screenshot renders (stored in Cloudflare R2) are retained to allow you to review historical checks. These assets are subject to a strict 30-day automatic deletion policy.
- Domain Health Checks: SPF, DKIM, and DMARC inspection records are automatically pruned after 90 days.
- Email Sandbox & Staging Messages: Inbound emails and SMTP relay captures are stored in strictly isolated tenant databases and automatically purged upon your plan retention window (up to 30 days). SMTP credentials are stored strictly as irreversible SHA-256 hashes with STARTTLS required in transit.
Payment Isolation & PCI-DSS Compliance
Emailens uses Polar.sh as our Merchant of Record (MoR) for all paid subscriptions and transactions, backed by Stripe infrastructure.
Zero Financial Data Exposure · PCI-DSS Level 1 Isolation
Credit card numbers, bank account details, and billing credentials are typed directly into Polar's hosted PCI-DSS Level 1 certified checkout environment. Emailens servers, databases, and logs never see, transmit, or store payment card numbers or CVCs. Polar handles sales tax, EU VAT collection, and statutory invoice generation on our behalf.
Infrastructure & Encryption
Emailens splits public marketing from the live product: static pages on Cloudflare Pages, and the Next.js application, API, and auth flows on a dedicated EU VPS. Data stores and payment providers we rely on maintain ISO 27001, SOC 2, and GDPR-aligned controls:
Marketing site (Cloudflare Pages)
emailens.dev is built as static assets and served from Cloudflare Pages with CDN
caching, automatic HTTPS, and TLS at the edge. Security headers (HSTS, CSP, frame
controls) are set via Cloudflare _headers.
Application (Hostinger KVM · Coolify)
app.emailens.dev runs as containerized services on a Hostinger KVM VPS in Europe, deployed and updated through self-hosted Coolify. Preview, API, and auth traffic are served over HTTPS with isolated Docker networks and pinned dependency images from CI (GitHub Actions → GHCR).
Data in transit
Browser and API clients connect only over HTTPS. Marketing and application responses include strict transport security and modern TLS. Webhooks and third-party integrations use encrypted connections end to end.
Data at rest (Supabase & R2)
Accounts, previews, and usage data live in Supabase PostgreSQL. Screenshot PNGs and large assets live in Cloudflare R2. Both use provider-managed encryption at rest (AES-256).
Authentication security
Powered by Better Auth with cryptographically salted and hashed passwords (Argon2id / bcrypt), secure HTTP-only session cookies, and OAuth 2.0 with PKCE for Google and GitHub sign-in.
Email Sandbox & SMTP Relay Security
Our SMTP relay (smtp.emailens.dev:2525) operates as an isolated non-forwarding quarantine sink. Staged test emails never escape to external public recipients. Relay authentication requires STARTTLS transport encryption, generated passwords are stored strictly as SHA-256 hashes, and users can rotate or revoke credentials with immediate termination.
GDPR Compliance & Data Rights
We fully comply with the European Union General Data Protection Regulation (GDPR) and UK GDPR. We provide self-serve tools so you can exercise your privacy rights at any time:
- Right to Access & Portability: You can download a complete machine-readable
JSON export of your user profile, saved templates, test histories, and API key metadata at
any time via our self-serve endpoint at
/api/user/export. - Right to Erasure ("Right to be Forgotten"): You can permanently delete your account from your account settings. Deletion triggers an immediate cascading purge of all associated database records, active sessions, API keys, and Cloudflare R2 screenshots.
- Data Processing Addendum (DPA): If your organization requires a formal DPA incorporating Standard Contractual Clauses (SCCs) for enterprise compliance, we provide our standard template upon request. Email dpa@emailens.dev .
Open Source Verification
Trust is earned through inspectability. The core rule engine behind Emailens, which evaluates CSS compatibility against 21 major desktop, mobile, and web email clients, is open source under the MIT license:
Anyone can inspect our parser logic, review our client compatibility datasets, or verify that our CSS parsing routines are deterministic and completely free of tracking code or covert analytics.
Vulnerability Disclosure
We take the security of our platform and users seriously. If you discover a security vulnerability in Emailens, please report it to us responsibly before any public disclosure:
Security Team Contact
security@emailens.devWe commit to acknowledging your report within 48 business hours and will not pursue legal action against security researchers acting in good faith.
We do not run a paid bug bounty. Every valid report gets a fix, a reply explaining what changed, and, if you want it, credit by name. The most useful reports show real impact on Emailens with steps to reproduce. Findings from automated scanners with no demonstrated impact (missing headers, DNS records, version banners) are welcome but are treated as hardening suggestions.
Acknowledgments
Thank you to the researchers who reported issues responsibly:
- Kunal Mhaske (October 2026)
See also: Privacy Policy / Terms of Service / Cookie Policy