Security & Trust

Our Security Philosophy

Email developers trust Emailens with pre-release transactional templates, product launch announcements, and critical design assets. Instead of burying our security practices behind opaque marketing claims or paid audit logos, we believe in radical technical transparency: providing clear, verifiable information on how your data moves through our infrastructure, where it is stored, and when it is destroyed.

Emailens offers optional AI-powered features, including AI Fix (which automatically patches unsupported CSS properties for target email clients) and the AI Builder (natural language template scaffolding and styling).

Inputs sent to AI endpoints are processed in-flight. We do not maintain any secondary vector databases, fine-tuning corpora, or offline training datasets of user emails.

Emailens is built around a principle of data minimization: we store only what is strictly necessary to provide you with preview results and account functionality.

• Unauthenticated Previews: Processed 100% in-memory in serverless edge functions. Raw HTML code is parsed against our CSS compatibility matrix, rendered, and discarded immediately after the HTTP response closes. No record is written to PostgreSQL.
• Authenticated Previews & Screenshots: When signed in, preview records and high-resolution screenshot renders (stored in Cloudflare R2) are retained to allow you to review historical checks. These assets are subject to a strict 30-day automatic deletion policy.
• Domain Health Checks: SPF, DKIM, and DMARC inspection records are automatically pruned after 90 days.
• Test Sends: Inbound test emails routed through our preview inbox are automatically purged from our database within 14 days.

Emailens uses Polar.sh as our Merchant of Record (MoR) for all paid subscriptions and transactions, backed by Stripe infrastructure.

Emailens is hosted on modern, resilient cloud infrastructure providers adhering to ISO 27001, SOC 2 Type II, and GDPR standards:

We fully comply with the European Union General Data Protection Regulation (GDPR) and UK GDPR. We provide self-serve tools so you can exercise your privacy rights at any time:

• Right to Access & Portability: You can download a complete machine-readable JSON export of your user profile, saved templates, test histories, and API key metadata at any time via our self-serve endpoint at /api/user/export.
• Right to Erasure ("Right to be Forgotten"): You can permanently delete your account from your account settings. Deletion triggers an immediate cascading purge of all associated database records, active sessions, API keys, and Cloudflare R2 screenshots.
• Data Processing Addendum (DPA): If your organization requires a formal DPA incorporating Standard Contractual Clauses (SCCs) for enterprise compliance, we provide our standard template upon request. Email [email protected] .

Trust is earned through inspectability. The core rule engine behind Emailens, which evaluates CSS compatibility against 21 major desktop, mobile, and web email clients, is open source under the MIT license:

github.com/emailens/engine ↗

Anyone can inspect our parser logic, review our client compatibility datasets, or verify that our CSS parsing routines are deterministic and completely free of tracking code or covert analytics.

We take the security of our platform and users seriously. If you discover a security vulnerability in Emailens, please report it to us responsibly before any public disclosure: