$ security
What is protected, and what is not yet certified.
Two lists. The first is what Pharos does about security today. The second is what it does not have — no certifications, no signed addendum, no contractual SLA — because you will find that out eventually and it may as well be here.
Reporting something: security@pharos.email
What Pharos does.
-
Mail in transit
The API is HTTPS only. The SMTP relay requires STARTTLS on submission, on port 587. Outbound delivery negotiates TLS wherever the receiving server offers it, which is almost everywhere that matters.
-
Credentials
An API key is scoped to one verified sending domain, shown once at creation, and revocable on its own. SMTP credentials are separate from both the API key and your account password, so the thing in a config file is never the thing that signs you in.
-
What the contact form never keeps
Registration happens at app.pharos.email, not on this site — this site never sees a password. The one form here is the contact form, and submissions are routed to a person, not into a third-party CRM.
-
Access to production
Restricted to the people who need it to operate the service. Pharos is small enough that this is a short list and honest enough to say that its shortness is the control.
-
Sending isolation
Sending IPs are dedicated to Pharos rather than drawn from a public shared pool, and an account can be moved to an isolated IP on request. One customer’s behaviour is not silently your reputation problem.
-
Analytics
This site loads no analytics script until you accept the banner, and the provider it then loads is cookieless. Rejecting means nothing is loaded at all, which is the only version of that question worth asking.
What Pharos does not have.
Every item here is a real gap, written plainly. None of it is on a roadmap slide with a date attached, and when one of them changes this page changes with it.
-
No SOC 2, ISO 27001 or HIPAA
None of the three is held. If your procurement process requires one, Pharos will not pass it today, and saying so now is cheaper for both of us than saying it in week six.
-
No published DPA
There is no standard Data Processing Addendum to counter-sign yet. The privacy policy describes what is processed and by whom; that is a description, not a contract.
-
No guaranteed data residency
Message data is not pinned to a region, and there is no EU-residency option to select. If where the data sits is a hard requirement, this is the answer.
-
No contractual uptime SLA
The status page publishes what actually happened, with 30-day uptime per component. That is a measurement, not a promise with money behind it.
-
No bug bounty
Reports are read, acknowledged and fixed, and you will be told what happened. There is no money attached, and pretending otherwise would waste a researcher’s time.
-
No penetration test report
There is no third-party penetration test report available to share. When one exists this page will say so, and will date it.
Reporting a vulnerability.
Write to security@pharos.email. Include what you found, how to reproduce it, and what you think the impact is. A person reads it.
You will get an acknowledgement within one working day and a real answer — fixed, in progress, or why it is not a problem — rather than silence. Please do not run automated scanners against the production API or the relay, and do not use a real customer’s data to demonstrate an issue. Test against your own account.
There is no bounty programme. What there is instead: a reply from someone who can fix it, and credit here if you want it.
Where the rest of it is written down.
The privacy policy covers what data is collected, how message data is kept separate from account data, who else processes it and how long it is kept. The terms cover availability and liability. The acceptable use policy covers what may be sent, which is a security question as much as a commercial one. Current operational state is on the status page.
Nothing here is a surprise later.
If a gap on this page rules Pharos out for you, that is the page working. If it does not, the free plan carries every feature and needs no card.
start free