Keep access specific.
Keep your data protected.

API keys with a clear scope

Restrict a key to one domain and one stream, and set an expiry date. Test keys (zap_test_…) run the full pipeline without delivering email to real recipients. Keep production keys on your backend.

Separate SMTP credentials

Create credentials for each application or environment. Limit them to a domain and revoke individual credentials when access changes. Connect over TLS or STARTTLS.

Signed webhook events

Verify signatures using your endpoint’s signing secret. Inspect delivery attempts, replay events, and rotate signing secrets without downtime.

Data retention and deletion

Logs include events, message content, and inbound email. Free retains three days, Pro 30 days, and Scale 90 days. Inbound attachments use signed download links; stored inbound messages can be deleted on request.

Security and data questions

Contact the team to discuss data location, subprocessors, contractual terms, and your application’s requirements.

Responsible disclosure

Report potential security issues privately. Include the affected component, reproduction steps, and impact. Keep credentials and personal data out of the initial report.