Security

Passwords are stored as hashes. We do not keep the password itself. Sign-in attempts are rate-limited. Session cookies are HTTP-only. On the public site they are Secure and SameSite=Lax.

Two-factor authentication is optional and uses a standard authenticator app. The shared secret is encrypted at rest. Recovery codes are shown once and stored only as hashes. A remembered device lasts 14 days and can be revoked. Changing the password or resetting two-factor ends those remembered devices. Existing sign-in sessions stay in place unless the person signs out.

Each person has a role: member, admin, or owner. Billing, domains, providers, and the audit log are limited to admins and owners. A platform admin who opens a workspace is recorded as impersonating.

Sending requires a postal address, and unsubscribes, hard bounces, and complaints are suppressed so a later campaign cannot mail them by accident.

Provider keys and two-factor secrets are encrypted before they are written to the database. Backups follow the host's disk backups. We do not offer a public bug-bounty program.

Report a security problem to admin@meenamarketing.com. Please include the page, the time, and what you observed. We read those messages during Monday–Friday, 9:00 a.m.–5:00 p.m. Eastern. Do not include a subscriber list or a live password in the report.