Skip to content
Duta

Security and data

API keys

Section titled “API keys”
  • A key is shown once, when you create it. Duta stores only a SHA-256 hash, so a copy of the database holds no usable key.
  • A key is send only unless you ask for full access. A send-only key cannot manage domains, keys or webhooks.
  • A revoked key stops working at once.
  • An account can have up to 25 live keys.

Request logs

Section titled “Request logs”

Every API request is logged so you can find it on the Logs screen. The Authorization header is never stored. Request and response bodies are kept for writes only, cut to 1 KB.

Message content

Section titled “Message content”

Each message’s content is kept so you can view it in the dashboard. Message content, message history and request logs are deleted once they pass your plan’s retention window: 7 days on Free and Starter, 30 days on Pro.

Signing keys and webhooks

Section titled “Signing keys and webhooks”
  • Duta generates a 2048-bit DKIM key for each domain. The private half goes to the mail provider and is never stored by Duta.
  • Webhook deliveries are signed with your endpoint’s secret, sent only to public https URLs and never follow redirects.
  • Attachments given as a path are fetched only from public https URLs.

Where data is processed

Section titled “Where data is processed”

Mail is sent through Amazon SES in ap-southeast-1 (Singapore). The API, the dashboard and their data run on Cloudflare.

Backups

Section titled “Backups”

Account and billing records are backed up weekly and kept for seven years, as business records must be. Message content and request logs are never backed up.

More

Section titled “More”