Skip to main content

​
Security

Learn about Lettr’s security practices and how to secure your integration.

​
Infrastructure Security

​
Data Centers

  • Location: AWS data centers in EU and US
  • Certifications: SOC 2 Type II, ISO 27001
  • Redundancy: Multi-AZ deployments

​
Network Security

  • All traffic encrypted with TLS 1.3
  • DDoS protection via Cloudflare
  • Web Application Firewall (WAF)
  • Regular penetration testing

​
Data Protection

​
Encryption

DataAt RestIn Transit
Email contentAES-256TLS 1.3
API keysAES-256TLS 1.3
Webhooks-TLS 1.3
AttachmentsAES-256TLS 1.3

​
Data Retention

Data TypeRetention
Email metadata90 days
Email content7 days
Logs30 days
Analytics1 year
Enterprise plans can customize retention periods.

​
API Security

​
Authentication

Always use API keys in headers, not URLs: 
// ✅ Good
fetch('https://api.lettr.dev/v1/emails', {
  headers: {
    'Authorization': 'Bearer le_xxxx'
  }
});

// ❌ Bad - API key in URL
fetch('https://api.lettr.dev/v1/emails?api_key=le_xxxx');

​
IP Allowlisting

Restrict API access by IP: 
const key = await lettr.apiKeys.create({
  name: 'Production',
  ipRestrictions: ['203.0.113.0/24']
});

​
Rate Limiting

PlanRate Limit
Free10 req/sec
Pro100 req/sec
EnterpriseCustom

​
Webhook Security

​
Signature Verification

Always verify webhook signatures: 
import { verifyWebhook } from 'lettr';

app.post('/webhooks', (req, res) => {
  try {
    const event = verifyWebhook(
      req.body,
      req.headers['lettr-signature'],
      process.env.WEBHOOK_SECRET
    );
    // Process verified event
  } catch (err) {
    res.status(400).send('Invalid signature');
  }
});

​
Webhook IP Addresses

Allowlist Lettr’s webhook IPs: 
203.0.113.10/32
203.0.113.11/32
203.0.113.12/32

​
Compliance

​
GDPR

  • Data processing agreements available
  • EU data residency option
  • Right to erasure support
  • Data portability

​
CAN-SPAM

  • Automatic unsubscribe handling
  • Physical address support
  • Opt-out processing

​
SOC 2

Lettr is SOC 2 Type II certified. Request our report:

Request SOC 2 Report

Contact us for compliance documentation

​
Best Practices

Create new keys and retire old ones every 90 days.
Never hardcode API keys in source code.
Only grant permissions that are needed.
Set up alerts for unusual activity.
Require two-factor authentication for all team members.

​
Vulnerability Reporting

Report security vulnerabilities responsibly:
We respond to all reports within 24 hours and offer a bug bounty program for qualifying vulnerabilities.