Transport

Everything is HTTPS. TLS terminates at the edge and the origin only accepts HTTPS. Outbound mail is sent with TLS required.

Credentials

API keys are stored as a SHA-256 hash of a high-entropy random value. The plaintext is shown once at creation and cannot be recovered — there is no endpoint that will reveal it. Revoking is immediate.

Verification codes are salted per organization and hashed with scrypt rather than a bare digest. A six-digit code has only a million possibilities, so a plain hash is recoverable in about a second by anyone who obtains the stored value; a slow key-derivation function turns that into days against a code that expires in 24 hours.

Inbound mail is authenticated

Received mail carries the SPF, DKIM and DMARC verdicts from the receiving path. A message failing DMARC — or failing both SPF and DKIM — is labelled unauthenticated and withheld from default listings. It is kept rather than dropped so you can inspect it, but it is never presented as though it were genuine. An agent acting on spoofed mail is the attack this exists to prevent.

Spam and virus verdicts are applied the same way.

Notifications are verified

Every provider notification we accept is signature-verified against the signing certificate, and the topic it claims to come from is checked against the one we expect. A valid signature only proves that some topic sent it; without the topic check, anyone able to create a topic could inject mail.

A signature that cannot be verified because the certificate endpoint is unreachable is treated as transient and retried, not as a forgery — the two are opposite answers, and collapsing them loses real mail.

Tokens are audience-bound

Access tokens for the MCP endpoint are only accepted when their aud is exactly https://api.carlyemail.com/mcp. A token issued by the same authorization server for a different service is refused. This is the confused-deputy attack that RFC 8707's resource parameter exists to prevent, and it fails open if you skip it.

Isolation

CarlyEmail runs in a dedicated AWS account, separate from any other product. Sending reputation is enforced per account, so this is what stops one product's mail problems becoming another's.

Within the API, an inbox-scoped key cannot reach a sibling inbox, and a resource belonging to another organization returns 404 rather than 403 — confirming existence is itself a disclosure.

Reporting

Found something? Write to support@carlyemail.com. We will acknowledge within two business days.