Account and team security
Account and team security
Lettermint supports account-level and team-level controls for securing access to your email infrastructure.
Account security
Users can secure their own account with passkeys and connected OAuth providers.
Team MFA enforcement
Members with Manage team security can require team members to use multi-factor authentication before accessing team resources.
Enterprise identity
Use SSO to route managed users through your identity provider, and SCIM to provision and deprovision users.
Managing SSO providers, SCIM tokens, role mappings, and team MFA enforcement requires Manage team security.
Token security
- Use Project API tokens only for sending.
- Use Team API tokens only for management automation.
- Create one token per integration.
- Add IP allowlists for tokens used from stable outbound IP addresses.
- Rotate or revoke tokens when ownership changes.
- Never expose tokens in client-side code.
MCP security
Members with Manage team security can control whether connected MCP applications may access a team. Disabling MCP blocks both new and existing connections from using that team immediately without disconnecting a member from other teams.
Personal information returned through MCP is filtered by default. The filter hides stored message identities and metadata, suppression values, and all message bodies or raw source. It also blocks identity searches, email sending, and suppression additions because their outcomes could confirm stored identities. Team, project, route, domain, and webhook configuration remains visible. See MCP server for the exact boundary.