1. DKIM Cryptography & Key Encryption at Rest
SendOFF provisions high-security 2048-bit RSA keys for every verified sending domain. Private keys are encrypted at rest using AES-256-GCM with versioned envelope encryption. The raw key is never accessible to browser clients or unprivileged processes.
2. Tenant Isolation via Row-Level Security (RLS)
Every database table enforces strict PostgreSQL Row-Level Security (RLS). Cross-tenant data leaks are cryptographically and architecturally prevented at the database kernel level. Service-role credentials never leave our backend VPS environment.
3. Webhook SSRF & IP Pinning Guards
When dispatching delivery webhooks to your servers, our background workers resolve DNS exactly once and validate the destination IP address at socket connect time. Private subnets (RFC 1918), loopback, link-local, AWS metadata (169.254.169.254), and carrier-grade NAT ranges are strictly blocked.
4. Constant-Time API Key Authentication
API keys are generated with sk_live_ prefixes and a high-entropy secret. Only the SHA-256 hash is persisted. Validation uses constant-time comparison buffers (crypto.timingSafeEqual) to prevent timing side-channel attacks.
5. Vulnerability Disclosure & Security Desk
We operate a responsible disclosure program. If you believe you have discovered a security issue, please contact our security engineering team immediately:
PGP / Disclosure: SendOFF Security Response