How Meisa protects your data and AWS keys

Meisa encrypts your email provider credentials (like your AWS access keys) at rest and never shows them in full after you save them. API keys are stored only as a hash, all traffic is encrypted with TLS, and you keep ownership of your data. We never sell or share your contacts.

Your AWS keys and other provider credentials

• Encrypted at rest. The keys you paste into Email setup are encrypted before they are stored in the database.
• Never shown again in full. After you save them, Meisa only shows a masked version. Nobody can read the full secret back out of the app or the API.
• Used only to send for you. Meisa uses them to send your email and set up delivery tracking in your own account.
• Least privilege. Create a dedicated IAM user for Meisa with only the sending permissions it needs, not your root or admin keys. See Create an AWS IAM user and access keys for Meisa.
• You stay in control. The keys live in your AWS account. You can deactivate or delete them in the AWS IAM console at any time, and Meisa stops being able to send through them. If you rotate keys, paste the new pair into Email setup.

API keys

• The full key is shown only once, when you create it. Copy it then.
• Meisa stores only a one-way hash of the key, so it can’t be shown again, even to us.
• You can revoke a key at any time in Settings, then API keys and webhooks. See Create and manage API keys.

Signing in

• Meisa has no passwords to leak. You sign in with Google or with a 6-digit code sent to your email.
• Each product has its own team and roles (owner, admin, member), so people only see the products they were invited to. See Invite team members.
• The Claude connector signs in with your Meisa account over OAuth. To cut it off, remove Meisa from your AI app’s connector settings.

Where your data lives

• The Meisa app, database and file storage are hosted by Hetzner in Helsinki, Finland.
• Data is encrypted in transit (TLS) and at rest.
• Payments go through Stripe. Meisa never stores your card number.
• When you send through your own provider (like Amazon SES), your emails and the recipient data they need go through that provider under your account.
• AI features (like Meisa Chat) send the email content, prompts and knowledge-base text needed for that feature to the AI provider that answers it.

The full list of services we use is in the Privacy Policy.

Your data is yours

• You own your contacts, email content and templates. We use them only to run the service for you.
• For your contacts’ data, you are the data controller and Meisa is the data processor.
• We don’t sell, rent or share your contacts with anyone for their marketing.
• To get a copy of your data, correct it, or delete your account, email [email protected] from the address on your account. When you delete your account, we delete your data within 30 days, unless the law requires us to keep it.

Unsubscribe and tracking links

Unsubscribe links in your emails are signed, so they can’t be guessed or changed to unsubscribe someone else. They work without a login and never expire.

Report a security issue

If you think you found a security problem, email [email protected] with the details.

Related articles

• Create an AWS IAM user and access keys for Meisa
• Unsubscribe links, CAN-SPAM and GDPR
• Create and manage API keys
• Contact Meisa support