Account boundaries, protected credentials, and deliberate delivery controls work together in Wush. Here is what the application protects and what you need to manage around it.
Last updated: September 21, 2026 · Wush by REKSIDE LLC
Infrastructure & server locations
Security starts with where your workspace runs. Wush is a self-hosted application, so server locations, physical access, and infrastructure safeguards depend on the hosting environment selected by the operator.
- Confirm where application data, backups, and connected services are hosted before importing sensitive information.
- The deployment operator is responsible for HTTPS, infrastructure access, software updates, and protecting encryption keys.
- Your SMTP provider, AI provider, and enabled billing services process information as part of the features you use. Their locations and safeguards may differ from those of your Wush deployment.
Data protection & recovery
Workspace data belongs to its account. Account controls help you manage that information, while recovery and retention also depend on how the service is operated.
- Contacts, audiences, campaigns, reports, and SMTP settings are scoped to the authenticated account.
- Account settings include a data export. Store exported files securely and share them only with authorized people.
- The deployment operator needs to configure, protect, and test backups. An account export does not replace an infrastructure recovery plan.
- Account deletion requires verification and may be blocked by billing retention requirements. It does not recall sent email or immediately remove every provider-held copy.
Application & account security
Contacts, audiences, campaigns, reports, and SMTP settings are scoped to the authenticated account. Passwords are stored as hashes, and public authentication requests are rate-limited to reduce repeated attempts.
- Use a strong, unique password for your Wush account.
- Keep your account and email-provider credentials private.
- Treat exported workspace data as sensitive information.
Credential & connection protection
Stored SMTP passwords are encrypted, and sensitive service credentials stay on the server. Remote SMTP connections require encryption. Protecting the deployment and the provider accounts remains essential.
- Configure an encrypted connection to your SMTP provider.
- Restrict access to hosting, encryption keys, and provider accounts.
- Keep software, backups, and operational access under review.
Campaign review & sending safeguards
AI-generated drafts remain pending review. Approval, hourly and daily limits, and queued delivery provide practical checks before and during a campaign. You can pause to investigate a problem.
- Review content and recipient details before approval.
- Set limits that fit your account and provider policies.
- Pausing does not recall a message already handed to the provider.
Privacy & connected services
Understanding where information goes is part of protecting it. Use only the contact information needed for your campaign and review the services involved in preparing and delivering it.
- Your configured SMTP provider receives recipient addresses and the messages you send.
- When you request AI drafts, the configured AI provider processes the campaign instructions and contact information included in that request.
- Campaign emails include an open-tracking image. The tracking event does not store a recipient IP address or user agent; email apps can block or preload that image, so an open is an approximate signal.
- Senders are responsible for appropriate notices, permissions, and handling recipient requests across their connected services.
Security scope & certifications
This page describes Wush’s application controls. It is not an independent audit report, a compliance certification, or a guarantee about a particular deployment.
- Encrypted connections and encrypted stored credentials do not provide end-to-end encrypted email. Messages are sent through your configured SMTP provider.
- Review hosting, key management, backups, provider access, and operational procedures alongside the application controls.
- A service provider’s certifications do not automatically certify Wush or your organization’s use of it.
If you notice a security issue
If you suspect unauthorized access, pause affected campaigns, change your Wush password, and rotate affected SMTP credentials with your provider. Review recent activity before resuming delivery.
- Use the contact page for the available support route, or sign in to Help & FAQ for account guidance.
- When describing an issue, include the affected feature, what happened, and steps to reproduce it using non-sensitive examples.
- Never include passwords, secret keys, complete contact lists, or another person’s private information in a report.