Admin
Security & Compliance
This guide covers the security controls you operate yourself — two-factor authentication, password hygiene, data export and deletion — and the compliance machinery around sending: unsubscribes, the suppression list, and consent.
In this guide you will:
- enable two-factor authentication and manage recovery codes
- change your password and export or delete your data
- manage the suppression list and unsubscribe history
- keep sends compliant with consent rules
Two-factor authentication
2FA lives in Settings → Security under Two-Factor Authentication, with an Enabled/Disabled badge:
- Click Set Up Two-Factor. Scan the QR code — or type the manual secret — into Google Authenticator, Microsoft Authenticator, Authy, 1Password, or any TOTP app.
- Enter the 6-digit code and click Enable 2FA.
- Copy Codes saves your recovery codes — store them somewhere that is not the authenticator device.
From then on, sign-in asks for a code after your password. To turn it off, Disable 2FA accepts either a current code or a recovery code; Regenerate Recovery Codes issues a new set and invalidates the old one.
Authenticator codes are time-based — if codes are rejected, check the device clock first. Without the device or a recovery code, regaining access requires support with identity verification, so treat recovery codes as seriously as the password.
Passwords
- Change your password in Settings → Security: current password, new password, confirm, then Update Password. The section shows when it was last changed, and attempts are rate-limited.
- New accounts require at least 12 characters; use a password manager and a unique password.
- Forgotten passwords are reset from the sign-in page — the reset link expires after about 10 minutes. See Accounts & authentication.
Your data: export and deletion
The Privacy & data card in Settings → Security offers both GDPR rights directly:
- Download my data — downloads
mailneo-data-export.json, a JSON summary of your account including a data inventory. - Delete account — the red zone. The dialog requires typing DELETE to confirm, then removes the account and signs you out. This is irreversible — export first if you need a copy.
Mailneo's policies are published at /privacy, /gdpr, /dpa, and /subprocessors.
Email account credentials
Gmail and Outlook connect over OAuth — Mailneo never sees those passwords, and access can be revoked from your Google or Microsoft account at any time. For SMTP connections, prefer app-specific passwords where your provider offers them, and disconnect unused accounts from the Email Accounts page.
Unsubscribes and the suppression list
When a recipient clicks an unsubscribe link they land on a hosted page showing which address is unsubscribing and from which campaign, with an optional feedback box. The opt-out takes effect immediately.
Settings → Unsubscribersis the team's suppression console:
- Stat tiles for Total Suppressed, the last 30 days, from campaigns, and manually added.
- Two sub-tabs: Suppression List (filterable by reason — Manual, Unsubscribed, Bounced, Complained) and Unsubscribe History.
- Add Email and Bulk Import put addresses on the list proactively — the right move for do-not-contact requests that arrive by reply. A remove/ resubscribe action exists for genuine mistakes.
Suppressed addresses are excluded from sends automatically, even if they appear in a campaign's recipient list or a CSV import — imports report them as "on suppression list, won't receive sends". There is no override, by design.
Consent and sending compliance
- Include an unsubscribe path in every campaign — the sequence editor's Add Unsubscribe Link button or the
{{unsubscribe_link}}variable. See Sequence. - For newsletter lists, double opt-in gives you a confirmation record per subscriber and keeps unconfirmed addresses out of sends — see Newsletters.
- Regulations like CAN-SPAM, GDPR, and CASL remain your responsibility as the sender: accurate sender identity, honest subject lines, and prompt honoring of opt-outs. Mailneo's summaries: /can-spam, /gdpr, /ccpa.