Security

Every connection to the Wayfinder portal and webmail is served over HTTPS with modern TLS. Mail is sent and received over encrypted SMTP and IMAP, and we use opportunistic TLS with remote servers wherever they support it. Mail at rest lives on encrypted volumes.

Each customer organization is a separate tenant. Domains, mailboxes, and billing records are scoped to an organization and enforced at the database layer with row-level security policies, so one customer's queries cannot reach another customer's data. Mailbox credentials are validated against the mail server itself, not mirrored into the app database.

Administrators can sign in with a passkey (FIDO2/WebAuthn), Google, or email and password. Passkeys are phishing-resistant and are the option we recommend. Passwords are stored only as salted hashes, and we check new passwords against known-breach lists. Mailbox users authenticate with their own mailbox credentials, separate from any administrator account.

Every domain is set up with SPF, DKIM, and DMARC during onboarding so your mail is authenticated and hard to spoof. Inbound mail is filtered for spam and malware, and outbound sending is rate-limited to keep our IP reputation clean for everyone.

Administrative access to mail infrastructure is restricted, key-based, and logged. We keep security event logs for sign-ins, credential changes, and failed authentication attempts, and mail data is backed up regularly with restores tested periodically.

If you believe you have found a security issue, email support@wayfinderemail.com with the subject line "Security" and enough detail to reproduce it. Please give us a reasonable window to fix the issue before disclosing it publicly. We will acknowledge your report within three business days.

See our Privacy Policy for what we collect and how long we keep it, and our Terms of Service for acceptable use.