Lumail
Sign up

Security and incident contact

How to report vulnerabilities and privacy incidents to Codelynx for Lumail

Last reviewed: 2026-09-15

This page describes how to reach Codelynx about security and personal-data incidents. It does not claim ISO, SOC, or other certifications. Organization owners and administrators can accept and download the current Data Processing Agreement.

Contacts

PurposeAddress
Privacy, DSAR follow-up, incident notice to Codelynx[email protected]
Product support[email protected]
OperatorCodelynx, LLC, 8 The Green STE B, Dover, Delaware 19901, United States

Vulnerability reports

Email [email protected] with a description, affected URL or API, and reproduction notes. Do not include secrets or customer personal data beyond the minimum needed to demonstrate the issue. We do not operate a paid bug-bounty program.

Customer incident updates

If Codelynx confirms a personal-data incident that affects subscriber or account data we process for a customer, we aim to notify that customer's organization without undue delay after confirmation. That processor-to-controller notice is separate from the customer's own deadline to notify a supervisory authority or data subjects.

We do not promise a fixed 72-hour customer SLA on this page. Statutory controller deadlines are the customer's obligation.

Measures we actually operate

Documented, evidenced controls — not certifications:

  • TLS in transit for the application and APIs
  • Organization-scoped data access and API tokens with permissions
  • Separate development and production environments
  • Passwordless email OTP for Lumail accounts (OTP mail is untracked)
  • Sent-email archives stored in Cloudflare R2; lawful erasure deletes known object keys
  • Hatchet workers self-hosted in Nuremberg; Postgres in Frankfurt
  • Bounce, complaint, and unsubscribe suppression to stop further sending

No service is completely secure. We cannot guarantee that unauthorized access, loss, or disclosure will never occur.

What to do as a customer

  1. Limit API-token permissions and rotate tokens after staff changes.
  2. Use separate development and production tokens.
  3. Enable native double opt-in before collecting marketing subscribers when that is appropriate for your market.
  4. Leave transactional tracking off unless you have a documented reason to enable it.
  5. Use lawful erasure for data-subject deletion; do not promise the disabled DELETE subscriber API.
  6. Report suspected incidents to [email protected].
PreviousSubprocessorsNextCustomer compliance guide