Security Overview

Commune is built with security as a foundational layer, not an afterthought. Every email — inbound and outbound — passes through multiple security systems designed specifically for AI agent use cases.

Security architecture

Inbound:  Sender → SPF/DKIM/DMARC check → Spam scoring → Prompt injection detection → Attachment scanning → Your agent
Outbound: Your agent → Content validation → Rate limiting → Burst detection → Warmup gate → DKIM signing → Recipient

Defense layers

Email Authentication

DKIM signing, SPF records, and DMARC policies ensure your emails are trusted and not spoofed.

Encryption at Rest

AES-256-GCM encryption for email content, webhook payloads, and secrets stored in the database.

Spam Prevention

SpamAssassin scoring on inbound emails + outbound content validation to prevent your agent from sending spam.

Prompt Injection Detection

AI-specific threat detection that analyzes inbound emails for prompt injection attempts targeting your agent.

Rate Limits

Per-second, daily, and burst-based rate limiting to prevent abuse and protect sender reputation.

Security by default

These protections are active for every Commune account — no configuration required:

Protection	Inbound	Outbound	Description
DKIM signing	—	✓	All outbound emails are DKIM-signed
SPF alignment	✓	✓	DNS records ensure sender authorization
Spam scoring	✓	—	SpamAssassin analysis on every inbound email
Content validation	—	✓	Blocks phishing patterns and spam content
Rate limiting	—	✓	Per-second and daily caps
Burst detection	—	✓	Detects and blocks abnormal sending spikes
Warmup gate	—	✓	Gradual volume increase for new inboxes Business
Email validation	—	✓	MX records, syntax, disposable domain detection
Suppression lists	—	✓	Auto-blocks known bad addresses
Bounce tracking	✓	—	Auto-suppresses hard bounces
Encryption at rest	✓	✓	AES-256-GCM for stored email content Business
Attachment scanning	✓	—	Antivirus and heuristic threat detection
Prompt injection	✓	—	AI-targeted attack detection Business
Audit logging	✓	✓	All API operations logged with TTL expiry Business
Request IDs	✓	✓	Every request gets a unique traceable ID

Security headers

All API responses include standard security headers:

Strict-Transport-Security — HSTS enforcement
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Request-Id — Unique request identifier for debugging

Authentication methods

Commune supports three authentication methods depending on who is making the request:

API Key
Agent Signing
Commune OAuth

Standard API key authentication for backend integrations. Every request includes a comm_ prefixed key.

Authorization: Bearer comm_xxx...

Keys are HMAC-SHA256 hashed before storage
Scoped to an organization
Can be rotated without downtime
Full docs

Ed25519 signature authentication for AI agents. No shared secrets — agents sign every request with their private key.

Authorization: Agent {agentId}:{base64_signature}
X-Commune-Timestamp: {unix_ms}

Agents generate their own keypair at registration
Each request includes a unique timestamp (replay protection)
No tokens to manage or rotate
Full docs

OAuth-based identity verification for third-party products. Agents sign in using their Commune email via a 6-digit code.

Authorization: Basic base64(client_id:client_secret)   ← integrator calls
Authorization: Bearer comm_oauth_xxx...                ← agentinfo calls

Integrators register an OAuth client to get credentials
Agents prove inbox ownership via OTP
Returns trust score, email reputation, operator details
Full docs

Infrastructure

Transport: HTTPS-only (HTTP is rejected)
Authentication: Multiple methods (API key, agent signing, OAuth) — see tabs above
Database: MongoDB with encryption at rest
Secrets: Webhook secrets and encryption keys are never exposed in API responses
Key management: Three-layer encryption key protection with fingerprint locking and canary verification

Compliance

GDPR: Full data deletion API with preview, confirmation tokens, and audit trail
Data residency: Email delivery through AWS regions (configurable per domain)
Audit logs: All operations logged to MongoDB with automatic TTL expiry
Key rotation: Dual-key rotation mechanism for zero-downtime encryption key changes

Explore security features

Email Authentication

DKIM, SPF, and DMARC — authenticate every email your agent sends.

Encryption

AES-256-GCM encryption for email content, secrets, and attachments.

Spam Prevention

Inbound spam scoring and outbound content validation.

Prompt Injection Detection

AI-specific threat detection on every inbound email.

Rate Limits

Burst detection, warmup gates, and sending health gates.

Data Deletion

GDPR-compliant deletion API with preview and audit trail.

Get Started

SDKs

Email

Commune OAuth

Phone & SMS

Security

Integrations

Examples

Community

Security Overview

Security architecture

Defense layers

Email Authentication

Encryption at Rest

Spam Prevention

Prompt Injection Detection

Rate Limits

Security by default

Security headers

Authentication methods

Infrastructure

Compliance

Explore security features

Email Authentication

Encryption

Spam Prevention

Prompt Injection Detection

Rate Limits

Data Deletion

​Security architecture

​Defense layers

Email Authentication

Encryption at Rest

Spam Prevention

Prompt Injection Detection

Rate Limits

​Security by default

​Security headers

​Authentication methods

​Infrastructure

​Compliance

​Explore security features

Email Authentication

Encryption

Spam Prevention

Prompt Injection Detection

Rate Limits

Data Deletion

Security architecture

Defense layers

Security by default

Security headers

Authentication methods

Infrastructure

Compliance

Explore security features