Transport security
Public production traffic uses HTTPS. SMTP and IMAP connections use the security mode configured for the mailbox and supported by its provider.
DATA PROTECTION
Versleutelingsmaatregelen
Review the protections used for transport, provider tokens and locally stored integration credentials.
Provider tokens
Supported OAuth access and refresh tokens are encrypted at rest with AES-256-GCM and private server-side encryption keys.
Application credentials
Account and mailbox API keys must remain in server-side environment variables or a secret manager. They grant mailbox operations and must be rotated after suspected exposure.
WordPress storage
The official plugin encrypts selected MailBridgeAPI credentials using key material derived from WordPress authentication salts. It does not copy the mailbox password to WordPress.
Operational boundary
Encryption reduces exposure; it does not replace access control, secure endpoints, key rotation, provider security or customer-side secret handling.