Trust
Security and privacy, by design.
The controls behind account access, verified senders, and authenticated delivery events.
Scoped API keys
Use send and read scopes to limit an integration’s access. Revoke keys from the dashboard when an integration no longer needs access.
Verified senders
Sending domains must be linked to your organization and verified. SNDR provides SPF, DKIM, and DMARC records for domain setup.
Processing locations
Sending regions are not currently selectable. Contact our team to confirm processing locations and contractual requirements; EU-only or Saudi-only residency is not guaranteed.
Signed webhooks
Webhook deliveries include timestamped HMAC-SHA256 signatures. Signing keys can be staged and promoted during rotation.
Hosted payments
Paddle handles payment collection through its checkout. SNDR uses billing identifiers and subscription status to manage your plan.
Account protection
Password authentication uses bcrypt hashing. Accounts can enable authenticator-based two-factor authentication and recovery codes.
How we keep data safe
Stored secrets
API keys are stored as SHA-256 hashes. Relay credentials that the service must read back use application-level AES-256-GCM encryption. These controls are distinct from database or infrastructure encryption.
Transport security
Use the HTTPS API for integration requests. Outbound SMTP attempts STARTTLS when the recipient server advertises it; transport encryption depends on the receiving server’s capabilities. Email delivery is not end-to-end encryption.
Access control
Authenticated requests are scoped to an organization. API-key scopes and role checks restrict supported operations. Do not share account credentials or put secret API keys in browser code.
Audit records
Security-sensitive actions, including API-key creation and revocation and domain changes, create audit records for review.
Organization boundaries
The application checks organization ownership when accessing customer resources. This is application-level authorization, not a claim of a dedicated database per customer.
Disaster recovery
Contact our team for verified backup, recovery, and hosting details before relying on specific recovery objectives.
Vulnerability disclosure
Report suspected security issues to sndr@rkiza.sa. Include the affected feature and reproduction steps, and avoid sending passwords, API keys, or customer message contents.
Subprocessors
Contact our team for the current subprocessor list, processing locations, and any applicable change-notification terms.
Subprocessors
Contact our team for current subprocessor and processing-location details.
The sending-domain settings do not choose a hosting or data residency location. If your service requires processing within a particular country, confirm support with us before sending that data.
Compliance and requirements
This page describes product controls, not a certification or contractual guarantee. Contact our team for current evidence before relying on an audit report, regulated-data agreement, recovery objective, or particular processing location.
Integration details: API reference and webhook verification.
Start building
Your next message starts here.
Connect your domain, create an API key, and send with SNDR.