Security

Clear controls. No invented certifications.

Here is what we actually do today — and what we do not claim.

Encrypted credentials
Per-domain Resend API keys are stored server-side and encrypted at rest. Full keys are never returned to the browser.
Organization isolation
Domains, mailboxes, and messages are scoped to the signed-in organization. Cross-organization access is rejected.
Session authentication
App access requires a signed-in session. Client apps do not talk to the database with open public access.
Attachment storage
Inbound attachments are stored in object storage under organization and domain paths.
Customer Resend keys for customer mail
Your domain sends and receives with your Resend credentials. Platform keys are only used for platform mail such as password resets and optional ops alerts.

Trust pages should stay boring and accurate.

We do not claim SOC 2, ISO, or similar certifications on this page.
We do not guarantee deliverability — that depends on your Resend account, DNS, and recipient filters.
Rmail is not affiliated with, endorsed by, or sponsored by Resend.