Skip to main content

​
Allowed senders

Every mailbox has an Allowed senders (one per line — empty allows everyone) list. Entries match either an exact address or a whole domain:
  • An entry like billing@acmesupplies.com matches only that exact address.
  • An entry like @acmesupplies.com matches any address at that domain.
  • An empty list allows everyone — fine for a personal inbox, risky for a mailbox that triggers webhooks.
Email from a sender not on the list is marked SKIPPED in the inbox: it is stored so you can see what was ignored, but never processed.

​
Webhook endpoint safety

Webhook URLs must be public HTTPS URLs. Plain HTTP, localhost, and private network addresses are rejected, so payloads are always encrypted in transit and a webhook can’t be pointed at internal infrastructure.

​
Signing secrets

Every webhook POST is signed with HMAC-SHA256 over the exact raw body and sent in X-BounceBox-Signature. Mailboxes use your workspace secret by default; set Signing secret on a mailbox to override it per endpoint. Verify signatures before parsing — see Webhooks.

​
Attachments

PDFs and supported images are available for extraction; spreadsheets (.xlsx, .xls, .csv) are converted to text on Pro and Custom. File size, provider support and legibility affect processing. Unsupported or unusable attachments can show as skipped or failed; a parse status does not guarantee all details were read.

​
Where your data lives

Email content may be processed by the configured model and service providers. Do not assume all processing occurs in one region. Stored raw emails and attachments are subject to scheduled expiry after 14 days on Starter or 30 days on Pro and Custom. Structured results and delivery logs are separate and may remain. A raw-input purge action is available in Settings → DATA & RETENTION; contact support for structured-data deletion or workspace closure requests. Details on processors and data handling are on our privacy page.