Security
Your email carries your name. We treat it that way.
How we protect your account, your data and the people you send to.
Where your data lives
One data center, in Germany.
Your account, contacts, templates and message history are stored on our servers in Falkenstein, Germany, under EU data protection law. Outgoing mail is handed to our delivery network only for the last hop to each recipient.
Hosted in Germany
Jumploon runs on dedicated infrastructure in Falkenstein, Germany. Your data is stored there; outgoing mail is handed to our delivery network for the last hop.
Encrypted in transit
The API, dashboard and tracking links are served over HTTPS only, with certificates managed automatically.
Hashed API keys
API keys are shown once and stored only as hashes. Keys can be scoped to sending, limited to a domain, and given an expiry date.
Account access
Passwords are hashed with scrypt. Sessions use HttpOnly cookies with CSRF protection, and login attempts are rate-limited.
Least privilege
Owner, admin and viewer roles, plus subaccounts, keep each person and app to what it needs.
Domain ownership
A domain can only send after its DKIM record is verified, and only one account can verify a domain.
Signed webhooks
Every webhook is signed so your server can reject forged events. Secrets can be rotated at any time.
Backups
The database is backed up nightly and backups are kept for 14 days.
Report a vulnerability
If you believe you've found a security issue, email security@jumploon.com. Please give us a reasonable time to fix it before disclosing it, and don't access other customers' data while testing.
Report abuse
Received spam or phishing sent through Jumploon? Forward it with full headers to abuse@jumploon.com. We investigate every report under our acceptable use policy.