Your mail runs on your accounts. Your data stays in your workspace. Here is exactly how we keep it that way, and what we expect from everyone who sends with Aircraf.
Every record in Aircraf belongs to exactly one workspace: inboxes, domains, contacts, lists, campaigns, sequences, replies and suppressions. Each request is scoped to the signed-in workspace on the server, so one customer can never read, send from or modify another customer's data.
Sending domains are verified per workspace with a DNS record, so you can only send from domains you have shown you control.
SMTP and IMAP passwords, SendGrid API keys and other provider secrets are encrypted with AES-256-GCM before they are written to the database. The key is held separately from the data, in the application environment. After you save a credential the interface only ever shows a masked version.
All traffic to Aircraf is served over HTTPS. Account passwords are stored as bcrypt hashes.
Aircraf does not operate a shared sending pool. Mail leaves through the Google Workspace, Microsoft 365, SMTP account or SendGrid account you connect, from domains you have verified. Your reputation is never mixed with other customers' traffic, and theirs is never mixed with yours.
You can disconnect an inbox or delete a credential at any time, and we stop using it immediately.
You are the sender of every message you send with Aircraf, and you are responsible for complying with the laws that apply to it, including CAN-SPAM, CASL, GDPR and PECR where relevant. Aircraf helps by enforcing the basics on every campaign email:
Contact data you upload is yours. We process it only to provide the service: sending your campaigns, tracking opens, clicks and replies, and showing you the results. We do not sell it, pool it across workspaces or use it to build our own lists. Read the full Privacy Policy and Terms of Service.
Aircraf is for relevant, one-to-one business outreach. It is not for bulk unsolicited mail, purchased consumer lists, phishing, or anything that hides who is sending. We watch bounce and complaint rates on every workspace.
We suspend accounts with high bounce or complaint rates, and accounts that send prohibited content, while we review them. Repeat or serious abuse ends in termination.
If you received unwanted mail sent through Aircraf, or you believe you have found a vulnerability, email advisor@fih.com. Include the full message headers for abuse reports. We read every report.
Connect an inbox, import a list and send. 14 days free, no card, cancel anytime.