Encryption at Rest
Payloads are encrypted at rest with AES-256-GCM and decrypted only in memory, exactly at fire time.
Trust and money are on the line, so we describe our reliability in honest, verifiable terms — and publish the real numbers instead of promising them.
Verifiable fundamentals instead of flashy promises — described only in honest terms.
Payloads are encrypted at rest with AES-256-GCM and decrypted only in memory, exactly at fire time.
Every outgoing webhook carries an X-SendIt-Signature header — verify it in one line, and rotate signing secrets with zero downtime.
Up to five retries with exponential backoff; once exhausted, the job is safely isolated in a Dead Letter Queue.
DNS is re-resolved just before firing to block private and metadata IPs, and redirects are never followed.
We record the actual fire time against the scheduled time on every send, then publish the real numbers. Second-level delivery with Early Firing — proven by data, not adjectives.
At fire time we record fired_at against the scheduled moment and store the real offset on each delivery. Once enough live traffic accrues, the service-wide numbers appear here — the same figures you see on your own dashboard.
Live service health is always on the status page.
The same signals we watch internally — API, database, delivery queue, and the fire worker — straight from the live health checks.
Auto-refreshes every 30 seconds. These signals come straight from the live service health checks.