Catalyst Mail uses passwordless magic-link authentication. No passwords are stored. Session tokens are opaque, HttpOnly, Secure, SameSite=Strict cookies backed by KV with 7-day expiry. Sessions are revocable. Optional Cloudflare Access (Zero Trust) for organization SSO.
All traffic uses TLS 1.3. Data at rest is encrypted by Cloudflare (D1, KV). No plaintext credentials are stored.
HTML email content is rendered in a sandboxed iframe to prevent XSS and external resource loading. Email content is never executed as active content.
Every database query is scoped by tenant_id. Email data is filtered by tenant at the API layer. Cross-tenant access is architecturally prevented.
AI inference runs via Cloudflare Workers AI in-region. Email content is sent for inference and not retained by the AI provider after the response. We do not train models on your data.
Catalyst Mail runs entirely on Cloudflare's edge network (Workers, D1, KV, Workers AI, Email Routing). No servers to patch. No third-party hosting.
Found a vulnerability? Email security@strategic-innovations.ai. We respond within 48 hours.