Security & incident reporting

Updated 26 October 2026 · Pilot policy version 1

These are the controls in the current pilot, not an independent security certification or a guarantee against incidents.

Application safeguards

• HTTPS for the API and dashboard. Private application storage is encrypted using AWS KMS-backed services in Sydney.
• Verified sender domains, account authentication, scoped API keys and revocable OAuth connections for agents. API keys are stored as hashes rather than retrievable plaintext.
• Per-team sending limits, request-rate limits, bounce/complaint processing and suppression checks on new send requests.
• Operational logs, queue-failure and reputation alarms, and database point-in-time recovery.

Mail transport to recipient systems depends on the sender domain’s TLS configuration and the recipient system. Do not assume end-to-end encryption or that a recipient’s mailbox is hosted in Australia. Email open/click tracking is optional.

Report a security incident or vulnerability

Email al@halyard.studio with the affected endpoint, approximate time, impact and safe reproduction steps. Send minimal, redacted evidence. Do not access other customers’ data, run disruptive tests or disclose an issue publicly before giving us a reasonable chance to investigate.

If you think an API key or agent connection was exposed, revoke it in the dashboard where possible and contact us. Do not include the credential in your report. This reporting channel does not promise a bounty or authorise testing of third-party systems.

Incident response

We investigate credible reports, contain affected access, preserve relevant evidence and assess who and what was affected. We will contact affected customers without undue delay when we identify an incident affecting their data, subject to legal and security constraints, and provide information needed to take protective steps. Where legally required, we notify the OAIC and affected individuals. There is no fixed 24/7 response-time guarantee during the pilot.

Assurance and current limits

Moonemail does not claim SOC 2 certification, ISO 27001 certification, its own IRAP assessment, government accreditation or blanket regulatory compliance. A provider’s certifications are not automatically Moonemail’s. Public signup and marketing campaigns are not enabled; retention and account-deletion limitations are disclosed in the privacy policy.