Least privilege, no stored secrets, auditable code
Email infrastructure holds keys to your identity. Here is exactly what OpenSES touches and how it keeps it safe.
AWS access
Cloud uses a cross-account IAM role with a unique External ID per workspace and short-lived STS sessions. Self-host supports instance roles so no key exists at all. Stored keys, where used, are encrypted with AES-256-GCM under a per-workspace data key.
Least privilege
The published IAM policy covers sending, identity and configuration-set management, suppression and quotas. No IAM, no S3, no billing access. SNS permissions are scoped to openses-* topics.
API keys
Prefixed (os_live_, os_test_), shown once, stored as SHA-256 hashes with a lookup prefix, scoped per workspace with read or write permissions. Rotation does not interrupt in-flight sends.
Email content
Bodies are stored encrypted at rest on Cloud and can be disabled entirely with metadata-only mode. Self-hosters decide retention; the default prunes bodies after 30 days.
Inbound events
Every SNS message is verified against Amazon's signing certificate before it is parsed. Webhooks you receive from OpenSES are signed with HMAC-SHA256 and carry a timestamp to prevent replay.
Deletion and export
Delete a workspace and its data is purged within 24 hours, including backups within 30. Export everything as JSON or CSV from the dashboard or the API at any time.