Security practices.
Supermail is email infrastructure. Security is not a feature — it is a requirement. This page describes how we handle email routing, data protection, and responsible disclosure.
Email routing infrastructure
Supermail operates a dedicated email routing layer for the supermail.cv domain. Incoming mail addressed to application aliases is received by Supermail's inbound processing system and never delivered to external mail servers without explicit user configuration. All routing decisions are logged and auditable.
Encrypted email processing
All email content is transmitted over TLS. Message processing occurs within isolated compute environments. Processed email metadata is stored in encrypted-at-rest databases. Supermail does not store raw email bodies beyond the processing window required to extract application signals.
Data protection
Supermail processes email metadata — sender address, subject line, timestamp, and inferred signal — to power application tracking inside Superfolio. Email content is not indexed, stored persistently, or used for any purpose beyond the feature that requested processing. Data is scoped to individual user accounts and never aggregated across users.
Abuse monitoring
Supermail actively monitors alias usage for patterns associated with abuse — including bulk outbound mail, phishing relay attempts, and spam distribution. Aliases found in violation of usage terms are suspended immediately. Reports from external parties are reviewed within 24 hours.
Responsible disclosure
If you discover a security vulnerability in Supermail infrastructure, we ask that you report it privately before public disclosure. We will acknowledge receipt within 48 hours, investigate promptly, and coordinate a fix and disclosure timeline with you. We do not pursue legal action against researchers acting in good faith.
Security contact
For vulnerability reports, security questions, or abuse concerns related to Supermail infrastructure, contact us directly.
security@supermail.cv