Built so a test can't go wrong for real

No real mail, by design

The mail server has no relay and no outbound SMTP client. Mail addressed to anyone, at any domain, stays in the universe it was sent to. The test suite builds the server binary and fails if any outbound mail capability is linked into it, so this cannot change by accident.

simmail does make some outbound connections, none of which carry mail: calls to the AI that writes replies, link clicks by simulated people, link reputation checks, DNS lookups by the deliverability checker, and webhooks to URLs you configure.

Sign-in

On hosted simmail, you sign in only at the platform. It is the only part of the system that checks passwords or talks to your identity provider. The servers that run universes never see a password.

After you sign in, the platform gives your browser a signed pass (Ed25519) that lasts 15 minutes. Every request to a universe checks that pass's signature and the role it grants. When it expires, the platform issues a new one if your session is still valid. Role changes and removals therefore take effect within 15 minutes, and signing out at the platform signs you out everywhere.

Keys and passwords

• API keys are shown once, when created. simmail stores only their SHA-256 hash. Sign-in sessions are stored the same way.
• Account passwords are hashed with bcrypt.
• App login passwords (the SMTP and IMAP credentials your apps use) are also stored as bcrypt hashes. Login names belong to your organization, so another customer using the same name neither collides with you nor learns that you exist.
• Webhooks can carry an HMAC-SHA256 signature of the body, so your endpoint can check that a call came from simmail.

Outbound requests can't reach inside

In customer universes, webhooks and link clicks by simulated people go to the public internet only. They are refused for private and internal network addresses, so a webhook URL or a link in an email cannot be used to reach simmail's own network. Link clicks are also rate limited per universe.

Isolation between universes

Each universe is its own world: its own mail, logins, people, clock, rules, webhooks and settings. All universe data is scoped to the universe it belongs to, and tests check that data written in one universe cannot be read from another through any API, protocol or query.

Retention and deletion

Your plan sets the longest that mail and activity are kept. You can set a shorter period for each universe; anything older is removed. Deleting a universe deletes it and all its data, and deleting an organization deletes every universe in it.

Staff access

To help with a support request, simmail staff can view the product as a customer sees it. Starting and ending this is recorded in the audit log, and while it happens the dashboard shows that a staff member is viewing.

Certifications

simmail does not hold SOC 2, ISO 27001 or other security certifications. If you need answers for a security review, email us and we will tell you what we can.

Reporting a vulnerability

Please email security@simmail.dev with what you found, how to reproduce it, and what you think the impact is. We will acknowledge your report, keep you updated while we fix it, and credit you if you would like.

Please test only against your own account and universes, do not access or change other customers' data, and do not run tests that degrade the service for others. Give us reasonable time to fix an issue before you disclose it publicly. We will not pursue anyone who reports in good faith and follows these guidelines.