Security & Trust
Effective date: 2026-07-31
Encryption
All data transmitted between your browser or API client and the AuraPost platform is encrypted using TLS 1.2 or higher, and we enforce HTTPS across all endpoints with HSTS headers to prevent protocol downgrade attacks. Data at rest — including account information, sending logs, template content, and suppression lists — is encrypted using AES-256 encryption on our storage layer. SMTP connections to upstream delivery providers are secured using STARTTLS or SMTPS, and we support DANE (DNS-based Authentication of Named Entities) where the receiving mail server announces it, providing an additional layer of transport security for high-value mail streams.
Authentication
AuraPost supports time-based one-time password (TOTP) two-factor authentication (2FA) for all accounts, and we strongly recommend enabling it. Our password policy requires a minimum of eight characters including uppercase, lowercase, numeric, and special characters. Idle sessions expire automatically after a period of inactivity, and all other active sessions are invalidated the moment you change your password, so a stolen session cookie does not survive a credential rotation. API keys are scoped to specific permissions and can be rotated or revoked individually without affecting your primary login credentials.
Domain Authentication
Before any domain can be used as a sending identity on AuraPost, it must pass DNS-based verification. We require all sending domains to have a valid Sender Policy Framework (SPF) record listing our mail servers as authorised senders, a DomainKeys Identified Mail (DKIM) signature using at least a 2048-bit RSA key added to your DNS, and a DMARC policy of at least p=none to enable reporting; we encourage customers to move to p=quarantine or p=reject once alignment is confirmed. Domains that fail verification are blocked from sending until the DNS records are corrected, protecting both our shared infrastructure reputation and your brand.
Infrastructure
AuraPost is built on Amazon Web Services (AWS), leveraging its enterprise-grade physical security, redundant power, network isolation, and compliance certifications including ISO 27001, SOC 2 Type II, and PCI DSS. We deploy into multiple AWS Availability Zones to provide high availability, and all production databases use automated point-in-time backup with a retention window of at least 30 days. Access to production infrastructure is limited to a small number of engineers, requires multi-factor authentication, and all access is logged and reviewed. We perform regular vulnerability scans and patch critical dependencies within 48 hours of a public disclosure.
Audit Logging
Every significant administrative action performed within the AuraPost platform is recorded in an immutable audit log, including account logins and logouts, password and 2FA changes, API key creation and revocation, domain verification events, team member additions or role changes, billing operations, and any action taken by AuraPost staff on your account (such as support impersonation, which is fully logged — every session start and end is recorded against the staff member who performed it). Audit log entries include a timestamp, the identity of the actor, the affected resource, and the action taken. Account owners can access their organisation's audit trail from the security settings page, and logs are retained for at least 90 days.
Responsible Disclosure
We take security vulnerabilities seriously and appreciate the efforts of security researchers who help us keep our platform safe. If you believe you have discovered a vulnerability in AuraPost, please report it to us responsibly by emailing support@theaurapost.com with a clear description of the issue, steps to reproduce it, and any supporting evidence. We commit to acknowledging your report within two business days, keeping you informed of our progress, and, where the issue is confirmed valid, crediting you in our acknowledgements. Please do not disclose the vulnerability publicly until we have had a reasonable opportunity to investigate and remediate it.