An email provider holds two things that matter: the credentials that can send as you, and the addresses of everyone you mail. This page states what protects them, and states nothing else.
A key is shown to you once, at creation. What is stored is a salted scrypt hash of it, alongside a short partial prefix so you can tell your keys apart in the dashboard. Nobody can read a key back out of the database: not support, not an operator, not an attacker with a copy of it. A leaked key is revoked by deleting it, and a key can be scoped to a single sending domain.
The site, the app and the asset host are served over HTTPS with certificates issued and renewed automatically at the edge. Every hostname is on a .dev domain, which is on the HSTS preload list, so browsers refuse to make a plaintext request to any of them in the first place. The downgrade is not available to attack.
Adding a sending domain generates the exact DNS records to publish: a DKIM record on a dedicated selector, an SPF record, and a DMARC record. Notix verifies them and keeps re-checking, so a domain that falls out of alignment surfaces as a status rather than as mail quietly landing in spam.
Hard bounces and complaints are added to your suppression list on receipt and are honoured by transactional and marketing sending alike. You cannot accidentally re-mail a burned address from the other side of the product, which is the failure that gets sending accounts suspended.
Provider notifications are read into a plain per-recipient reason (mailbox full, does not exist, marked as spam) and emitted as webhook events your systems can act on. Nothing about the fate of a message is hidden from you.
The administrative console is restricted at the edge to an IP allowlist as well as by authentication, and the internal service header the admin app authenticates with is stripped from every inbound public request before it can reach the application. A value forged from the internet never arrives.
Email security@usenotix.dev with steps to reproduce. We acknowledge reports within 3 business days and will tell you when a fix ships. We do not pursue legal action against good-faith research, and we are happy to credit you.
Notix is operated by HitchAfrica Technologies Limited. Notix holds no third-party security certification and this page claims none. If you need a signed questionnaire, a DPA or a sub-processor list, ask and you will get an honest answer about what exists today.
What data Notix processes, and on whose behalf, is set out in the privacy policy.