Security: how Courier protects your data

How Courier protects your data

Area	What Courier does
Infrastructure	Runs on AWS across multiple availability zones, inside a private network with firewalls and intrusion detection.
Encryption	Encrypts customer data at rest. The API accepts HTTPS only.
Backups	Backs up data daily.
Staff access	Staff use multi-factor authentication on internal systems, and access to customer data is restricted.
Testing	An independent firm runs a penetration test every year, and Courier manages vulnerabilities and patches.
Data location	Your data stays in the you send it through, US or EU.

Secure your workspace

Control	What it does
	Teammates sign in through Google, GitHub, or Okta. SCIM creates, updates, and deactivates them from your directory.
	Limit what each teammate can change and how much of a message log they see.
	Records API key rotations, role changes, publishes, and integration edits, with who and when.
	Each key is scoped to one environment and one permission level.
	Prove an outbound webhook came from Courier before you act on it.
	Your backend mints a JWT for each user, so the browser never holds your API key.

FAQ

Can I self-host Courier?

Courier is a managed cloud platform, with no self-hosted or on-premise option. To keep notification data in Europe, send through the .

How do I report a security issue?

Report it through Courier’s responsible disclosure policy.

Where can I check Courier's uptime?

The Courier status page shows current incidents and uptime.

How Courier protects your data