Skip to main content

​
Allowed senders

Every mailbox has an Allowed senders (one per line — empty allows everyone) list. Entries match either an exact address or a whole domain:
  • An entry like billing@acmesupplies.com matches only that exact address.
  • An entry like @acmesupplies.com matches any address at that domain.
  • An empty list allows everyone — fine for a personal inbox, risky for a mailbox that triggers webhooks.
Email from a sender not on the list is marked SKIPPED in the inbox: it is stored so you can see what was ignored, but never processed.

​
Webhook endpoint safety

Webhook URLs must be public — BounceBox accepts both HTTP and HTTPS, but rejects localhost and private network addresses, so a webhook can’t be pointed at internal infrastructure.

​
Signing secrets

Every webhook POST is signed with HMAC-SHA256 over the exact raw body and sent in X-BounceBox-Signature. Mailboxes use your workspace secret by default; set Signing secret on a mailbox to override it per endpoint. Verify signatures before parsing — see Webhooks.

​
Attachments

PDF attachments are capped at 15 MB per email. PDFs and images are read in full; spreadsheets (.xlsx, .xls, .csv) are converted to text (Pro). Unsupported or unusable attachments show as skipped or failed in the inbox.

​
Where your data lives

All data is hosted in the EU (Stockholm). Only the content needed for the mailbox’s configured extraction is processed. Raw emails and attachments are deleted automatically after 14 days (Starter) or 30 days (Pro and Custom) — extracted results and delivery logs are kept. To purge sooner, go to Settings → DATA & RETENTION → Delete all raw emails now. Details on processors and data handling are on our privacy page.