1. Overview
MailCutover's core function requires it to hold some of the most sensitive credentials a customer can hand over — root SSH passwords, cPanel/Plesk account passwords, and IMAP credentials for live mail servers. This page describes the concrete technical measures we take to protect that data, so you can evaluate them alongside your own security requirements.
2. Encryption at Rest
Source and destination server credentials, and the migration password used to authenticate
destination mailboxes, are encrypted using AES-256-GCM before being written to our PostgreSQL
database. Each value is encrypted with its own random initialization vector and authentication
tag, and is only decrypted transiently, in memory, at the moment it is needed to open an SSH
session or run imapsync.
3. Encryption in Transit
Traffic between your browser and our servers is encrypted in transit (TLS) at our reverse
proxy. Server-to-server operations that the migration engine performs — connecting to your
source and destination hosts to reset passwords, poll restore status, and run
imapsync — are carried out over SSH.
4. Authentication & Access Control
Dashboard sign-in is handled by Clerk, our authentication provider, supporting standard modern session security practices. Every resource in the Service — projects, mailbox accounts, jobs, and reports — is scoped to the specific personal or organization workspace that owns it at the database-query level, so one workspace's data is never visible to another, whether accessed through the dashboard or the API.
5. API Key Storage
API keys are never stored in a form that could be reversed back into the original credential. Only a SHA-256 hash of the full key is kept; the raw key is shown to you exactly once, at creation time, and cannot be retrieved again afterward — losing it means revoking it and generating a new one, the same way you'd treat a lost password.
6. Input Validation
Hostnames, usernames, and domains you submit are validated against a strict allow-list pattern and escaped before being interpolated into any remote shell command, so that a malicious or malformed value cannot break out of its intended argument and execute an unintended command on a server the Service connects to.
7. Infrastructure
The Service runs on PostgreSQL for durable storage and Redis-backed job queues to run migrations reliably in the background, deployed via Docker. Migration jobs are executed with bounded retries and timeouts so a single unreachable server cannot indefinitely occupy shared processing capacity.
8. Rate Limiting
API requests authenticated with an API key are rate-limited per key to protect the Service's availability for all customers. Dashboard sessions are not subject to this limit.
9. Vulnerability Disclosure
If you believe you've found a security vulnerability in the Service, please report it to hello@mailcutover.io rather than filing a public issue. We ask that you give us a reasonable opportunity to investigate and address a report before disclosing it publicly.
10. Subprocessors
A full list of the third-party services involved in operating MailCutover — Clerk, Stripe (via Clerk Billing), and Resend — is documented in our Privacy Policy.