> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bouncebox.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Senders & security

> Control who can trigger extraction, protect your webhook, and understand where your data lives.

## Allowed senders

Every mailbox has an **Allowed senders (one per line — empty allows everyone)** list. Entries match either an exact address or a whole domain:

```text theme={null}
billing@acmesupplies.com
@acmesupplies.com
ap@northwind-trading.com
```

* An entry like `billing@acmesupplies.com` matches only that exact address.
* An entry like `@acmesupplies.com` matches any address at that domain.
* An empty list allows everyone — fine for a personal inbox, risky for a mailbox that triggers webhooks.

Email from a sender not on the list is marked `SKIPPED` in the inbox: it is stored so you can see what was ignored, but never processed.

## Webhook endpoint safety

Webhook URLs must be **public** — BounceBox accepts both HTTP and HTTPS, but rejects localhost and private network addresses, so a webhook can't be pointed at internal infrastructure.

## Signing secrets

Every webhook POST is signed with HMAC-SHA256 over the exact raw body and sent in `X-BounceBox-Signature`. Mailboxes use your workspace secret by default; set **Signing secret** on a mailbox to override it per endpoint. Verify signatures before parsing — see [Webhooks](/configuration/webhooks).

## Attachments

PDF attachments are capped at **15 MB** per email. PDFs and images are read in full; spreadsheets (`.xlsx`, `.xls`, `.csv`) are converted to text (Pro). Unsupported or unusable attachments show as `skipped` or `failed` in the inbox.

## Where your data lives

All data is hosted in the **EU (Stockholm)**. Only the content needed for the mailbox's configured extraction is processed. Raw emails and attachments are deleted automatically after 14 days (Starter) or 30 days (Pro and Custom) — extracted results and delivery logs are kept. To purge sooner, go to **Settings → DATA & RETENTION → Delete all raw emails now**.

Details on processors and data handling are on our [privacy page](https://bouncebox.app/privacy).