Security and data
Built to handle contact data carefully.
Mailyard holds your lists and the addresses we find, so organizations stay isolated, logs stay redacted and webhooks are signed.
Your data stays in your organization.
Access is checked on each request, and each query is scoped to your organization.
Used for your campaigns only.
Uploads and found addresses serve your campaigns alone, and logs are redacted.
We never look up where someone lives.
Research covers where a company says it operates: its website, LinkedIn page, listings and filings.
A suppression list that always wins.
Emails, domains, LinkedIn profiles or companies. Suppressed people are left out of every drop.
How it's protected.
- Encryption in transit
- HTTPS for the app, API and links, and encrypted database connections.
- Hashed API keys
- Shown once, stored as a hash, and revocable at once.
- Signed webhooks
- HMAC-SHA256 over a timestamp and the raw body, so forgeries and replays fail.
- Untrusted inbound events
- Provider events are signature-checked and deduplicated.
- Roles
- Owners, campaign managers, reviewers and analysts. Only owners create keys or change the plan.
- Audit trail
- Sensitive actions are recorded without copying personal data.
- Private letter pages
- Long random links, not indexed, no referrer.
- Revocable share links
- View-only analytics links are off by default, and a reset kills the old link.
Mail safety
Nothing mails by accident.
A drop needs approved proofs, payment for that exact version, resolved holds, a date 24+ hours out and, in the beta, our team's review.
How approvals work →Questions
Security questions go to hello@mailyard.ai.
Can Mailyard be used for health or other regulated data?
No. Upload business contact details only: names, work emails, LinkedIn profiles, companies and business locations.
Who at Mailyard can see my data?
During the beta, our team reviews each drop's campaign and letter before it prints. Ask us for more detail for a vendor review.
Do you store IP addresses when someone scans a QR code?
No. A scan records the time, the contact and a truncated device description used to filter out link scanners.
Related
Turn emails and LinkedIn profiles into verified business mailing addresses, with the sources behind each one. Pay only for mailable results.
API and webhooksA REST API for address research, lead lists, enrollments, QR codes and scans, with signed webhooks for every result.
FAQAnswers about address finding, USPS verification, pricing and credits, approvals, sending, tracking, integrations and data handling.
Managed serviceTell us who you want to reach. Our team builds the list, writes and designs the letter, runs approvals with you and reports the results.
Your next touchpoint fits in an envelope.
Upload a list and see how many addresses we can verify before you spend anything on postage.