SECURITY
Security at ZeroDrop
Last updated: October 13, 2026
Our security posture
ZeroDrop runs on industry-standard providers with their own security certifications. We are not ISO 27001 or SOC 2 certified ourselves. This page describes what we actually do — including controls that are still being tuned — rather than what we aspire to.
Transport security
All connections to ZeroDrop — the dashboard, the API, and our backend infrastructure — use TLS, with TLS 1.3 where your client supports it. HTTP requests are redirected to HTTPS.
Network protection
ZeroDrop runs behind Cloudflare, which provides DDoS mitigation, and we use Cloudflare firewall rules to block abusive traffic. Inbound email is handled by Cloudflare Workers running on Cloudflare's global network.
Data storage and encryption
Emails are stored in Upstash Redis, encrypted at rest. Each email is stored together with its 30-minute expiry in a single atomic operation, so an email can't be written without its deletion timer. API keys are stored only as SHA-256 hashes, plus their last four characters so you can tell keys apart: a key is shown once, when it's created, and can't be shown again. GitHub access tokens are used during sign-in and never stored; we ask GitHub to revoke each one straight away. We do not store payment card data — all payments are handled by Dodo Payments, which is PCI DSS compliant.
Data isolation
Without an API key, inbox names are the access control: anyone who knows an inbox name can read it, so names are random and generated client-side. Don't use keyless inboxes for anything sensitive. A free API key gives your account an inbox prefix (such as k7x2-), and inboxes under it can be read only with that key. Replacing a key stops the old one at once, including streams already open. Deleting an account retires its prefix, so no later account can read mail sent to it. Workspaces receive mail on your own custom domain rather than the shared sandbox domain. Inbox names are validated on every read and write, so a request can only ever address a single inbox.
What we collect — and what we don't
Inboxes without a key need no account, cookie, or fingerprint. Signing in with GitHub for a free API key sets a sign-in cookie, and the account holds your GitHub user ID, username and email address. We do not use advertising trackers or third-party analytics scripts. We record inbox names, client source tags, user agents, and message metadata (sender, subject, timestamps) for usage analytics and abuse detection. Sender domains show which organisation sent mail; we don't try to identify individual people. Our infrastructure providers keep standard request logs (IP address, user agent, request path) for up to 7 days. The Privacy Policy has the full list and retention periods. No client-side telemetry: ZeroDrop's SDKs, MCP server, and GitHub Action make no network requests other than the API calls you invoke. Every client is open source; you can verify this in one read.
Abuse controls
Inbound mail passes through automated controls on Cloudflare Workers: — Recipient validation — malformed addresses are rejected — A sender blocklist — mail from platforms whose verification codes were being farmed through free inboxes is rejected — A daily allowance: without an API key, one sender can reach 5 different inboxes a day The allowance runs in monitoring mode for now — it logs what it would hold rather than holding it — so that legitimate test mail isn't lost while API keys roll out. No AI model processes your email.
Infrastructure providers
Our infrastructure stack: — Cloudflare (Email Routing, Workers, DDoS protection) — ISO 27001, SOC 2 Type II certified — Upstash Redis (email storage) — SOC 2 Type II certified — Vercel (dashboard and API hosting) — SOC 2 Type II certified — Dodo Payments (payment processing) — PCI DSS compliant We inherit the security posture of these providers for their respective components.
Responsible disclosure
If you discover a security vulnerability in ZeroDrop, please report it responsibly to [email protected]. Please include a description of the vulnerability, steps to reproduce it, and your assessment of the potential impact. We will respond within 48 hours and work to address confirmed vulnerabilities promptly. We ask that you do not publicly disclose the vulnerability until we have had the opportunity to investigate and remediate it.
Security updates
We monitor our dependencies for known vulnerabilities and apply security patches promptly. Our infrastructure providers handle operating system and runtime security updates on their respective platforms.
Contact
Security concerns: [email protected]
General support: [email protected]
Privacy questions: [email protected]