Security

Nexthome Labs operates its own infrastructure: a control plane, authoritative DNS pair, public edge nodes, and isolated runtime workers. Security is designed into that architecture rather than layered on top of it.

• All public traffic is served over TLS with modern cipher suites; customer domains receive automatic certificates.
• Inter-node control traffic crosses a private WireGuard overlay network, not the public internet.
• Passwords are stored as strong one-way hashes; mailbox onboarding uses short-lived one-time PINs that must be replaced.
• Backups and release artifacts are stored with access controls and encryption at rest.

• Customer workloads run in isolated containers on dedicated runtime workers, separated from the control plane.
• Builds execute through a restricted, brokered runner rather than the application servers.
• Each node role (edge, worker, DNS, SMTP) uses independent least-privilege tokens; no node holds the full control-plane environment.
• Administrative access requires the separate admin console with its own session and audit trail.

• ProperInbox domains are guided through SPF, DKIM, and DMARC setup with health checks in the dashboard.
• Nextsend enforces verified sending domains and scoped API tokens, and maintains automatic suppression lists for bounces and complaints.
• The transactional MTA runs on an isolated node separated from web and mailbox infrastructure.

• Immutable, timestamped releases with atomic activation and last-known-good rollback.
• Audit logging of administrative and account actions.
• Regular database backups with tested restore procedures.
• Dependency and lockfile-based builds for reproducible releases.

• Use a unique, strong password and protect API tokens.
• Scope Nextsend tokens per application and rotate them regularly.
• Publish the recommended SPF, DKIM, and DMARC records.
• Remove access for departed team members promptly.

We welcome security reports. Email [email protected] with details and reproduction steps. We acknowledge reports within 3 business days, investigate promptly, and credit researchers who report responsibly — please do not access data that is not yours, disrupt service, or disclose publicly before we have had a reasonable opportunity to fix the issue.