VuloMail handles the credentials for your email and SMS accounts and a record of what your site sends. Here's exactly how it treats both.
Encrypted at rest
Every password and API key is encrypted with libsodium's secretbox and a random nonce before it touches the database.
Never shown again
Saved secrets come back as eight dots and the last four characters. Leave a masked field alone and the stored value is kept.
HTTPS only, no redirects
Outbound calls refuse anything but https, never follow a redirect that could forward your key, and refuse private and loopback addresses.
Scrubbed error text
Provider responses can echo a credential. Known secrets, Authorization headers and key=value pairs are removed before an error is logged or shown.
Injection guards
No line breaks are allowed in any stored value, address, name or header. Account IDs are validated before they enter a URL.
Administrators only
Every screen and every REST route requires manage_options. Logged bodies are shown as plain text, never rendered as HTML.
Two halves. Neither is enough alone.
The encryption key is derived from a secret in your site's config and random material in your database. Someone holding a database dump can't read your credentials, and neither can someone holding only wp-config.php.
VULOMAIL_ENCRYPTION_KEY to control this yourself.A database dump alone, or the config file alone, can't read a credential.
Strict by default. Generous when you choose.
Bodies can contain password-reset links and personal details. Store them only if you need to read or resend messages.
Store j•••@example.com and •••••••••123 instead of full addresses and numbers. Masked entries can't be resent.
Older entries are pruned daily. Set 0 to keep everything, or up to 3,650 days.
Turn it off entirely if you must not keep any record. The dashboard totals then stay at zero.
Everything VuloMail stores, in your own database
{prefix}vulomail_logsTableOne row per message. Bodies are NULL unless you store content.vulomail_settingsOptionEvery setting you can change in the admin.vulomail_connectionsOptionYour connections, with secret fields encrypted.vulomail_key_materialOptionRandom half of the encryption key material.vulomail_prune_logsDaily eventDeletes entries older than your retention period.No post types, no user meta, no post meta. On uninstall, nothing is removed unless you chose Delete everything. Then the table, options, transients and scheduled event are all cleared.
No tracking. No phoning home.
VuloMail contacts only the providers you connect, and only to send the messages your site asks it to. It contacts no VuloLabs server and needs no account.
Private by design. Free by default.
Install VuloMail, connect the provider you already pay for, and send your first test in about five minutes.