Trust

Trust the behavior,
not the badges.

What we can see, what we store, how changes stay reversible, and what happens when something goes wrong. In plain terms, with the receipts linked.

We never see your mail. The product runs on the aggregate reports receivers publish: counts and pass/fail results, never message content, never mailbox access.

The behavior

Checkable, not claimed.

Credentials are hashed, not stored.

API keys and MCP tokens are SHA-256 hashed at rest and shown once at mint. Revocation is instant: every call re-checks the key's live permissions.

DNS changes have a safety net.

Every automated DNS write is staged with a five-minute hold, an email record, a 24-hour undo, and a read-back check. Nothing touches your zone silently.

Audited vendors underneath.

Data lives on Cloudflare and Neon (both SOC 2 Type II), auth runs on Clerk, payments on Stripe. We publish who processes what, and we hold no card data ourselves.

AI with zero data retention.

The AI features run under a zero-data-retention agreement with the model vendor: your report data is not retained or used for training.

Every action is on the record.

Workspace changes land in an audit log with provenance: a human click, an API key, an MCP token, or a Slack approval each show up as exactly what they were.

Your data is deletable.

Account deletion is self-serve, no email chain required. Delivery Diagnosis never stores message bodies, and its cases purge after 90 days.

Who's behind this

TrustYourInbox is founded and run by Dinesh Mistry: twenty years in email security, formerly product management at Agari, the company whose founders helped create the DMARC standard.

Meet the founder

The receipts

Read the paper trail

Found something? security@trustyourinbox.com reaches a human, and the bounty program pays for it.

Trust the behavior, not the badges.