Email API Security
Security is foundational to every layer of the QueenSMTP.COM platform. From key generation to event delivery, each component is designed to protect your data, your recipients, and your sending reputation.
API Key Management
API keys are generated in your dashboard and can be revoked or rotated at any time without downtime. We recommend creating separate keys for each environment — development, staging, and production — so that revoking a compromised key in one environment does not disrupt the others. Keys are stored using one-way hashing on our servers, which means even in the unlikely event of a data breach, raw key values cannot be recovered.
Domain-Scoped Keys
Each API key can be scoped to one or more verified sending domains. A domain-scoped key can only send from addresses that belong to its authorised domains, preventing misuse if a key is accidentally exposed. This granular scoping also simplifies compliance audits by clearly linking each key to a specific business unit, product line, or client.
IP Allowlisting
For an additional layer of protection, you can restrict each API key to a set of approved IP addresses or CIDR ranges. Requests originating from any other IP are rejected with a 403 Forbidden response before they reach the sending pipeline. IP allowlisting is especially valuable for production keys that should only be used from known server infrastructure, eliminating the risk of key misuse from unauthorised networks.
TLS-Only Connections
All communication with the QueenSMTP.COM API and SMTP endpoints is encrypted using TLS 1.2 or higher. Plaintext connections are refused at the network level. This ensures that API keys, email content, and recipient data are never transmitted in the clear, meeting the encryption requirements of GDPR, HIPAA, and SOC 2 compliance frameworks.
HMAC Webhook Signatures
Every webhook payload is signed with an HMAC-SHA256 signature using a per-account secret. Your application should verify this signature before processing the payload to confirm that the event originated from QueenSMTP.COM and was not tampered with in transit. The signature is included in the X-QueenSMTP-Signature header, and all SDKs provide a helper method to perform verification in a single function call.
Audit Logging
All API activity — key creation, sending requests, configuration changes, and login events — is recorded in a tamper-proof audit log accessible from your dashboard. Logs are retained for ninety days on all plans and up to one year on Enterprise plans. You can filter by date, key, event type, or IP address, making it straightforward to investigate anomalies or satisfy compliance requests.