security

Encryption

security/encryption/page.mdx — Technical details for the security-conscious:

• OAuth tokens encrypted at rest using better-auth’s built-in encryption, keyed to BETTER_AUTH_SECRET
• SMTP between sender and Stalwart uses STARTTLS on port 587 or implicit TLS on port 465
• Stalwart’s HTTPS (port 443) uses auto-renewed Let’s Encrypt certificates via ACME tls-alpn-01
• Webhook traffic from Stalwart to Vercel goes over HTTPS
• Gmail API calls go over HTTPS
• End-to-end: every hop in the chain is encrypted in transit. At-rest encryption covers the database.