Emails Driftstack sends

Driftstack sends transactional email through Postmark, from [email protected]; mail from support comes from the @driftstack.dev address you wrote to or from [email protected] (see Support). This page lists every email the platform sends today, what triggers it, and whether you can opt out. Anything claiming to be from Driftstack but sent from a different address or service isn’t us — report it to [email protected].

Required for the account to work — not opt-outable.

Email	Trigger
Verify your Driftstack account	Signup and the Resend verification email button send this single-use link. Signup-verification links expire after 30 minutes. Re-triggering mints a fresh token; earlier ones keep working until they expire, and using any one retires the rest. Where the same-answer sign-up is switched on (off by default), signing up again with the address of an account that was never verified sends this email again, opening with a note that the first password still holds and how to reset it.
Your Driftstack sign-in link	Sign in with a magic link instead on the sign-in page, then Send sign-in link. Single-use link, 60-minute expiry. Asking again sends a fresh link; earlier ones keep working until they expire, and signing in with any one retires the rest. If you didn’t ask for it, you can ignore it.
Reset your Driftstack password	The Forgot password link on the sign-in page. Single-use link, 60-minute expiry.
Someone tried to sign up with your Driftstack email address	NOT CURRENTLY SENT — it belongs to the same-answer sign-up, which is off on this deployment. When it is on: someone signed up with the address of an existing, verified account. No new account is made and nothing on your account changes; the email links the sign-in page and the password reset. Limited per address, like the other sign-in emails.
Confirm a new sign-in method on your account	Signing in with Google or GitHub using an email that already has a Driftstack account but no OAuth link yet. The link confirms the merge of the new sign-in method.
Someone is trying to sign in to your Driftstack account	Someone got past the first step of signing in — with the account’s password, a sign-in link sent to the address, or a linked Google or GitHub account — then entered the wrong two-factor code 10 times in 15 minutes. Two-factor sign-in that way is paused for 15 minutes; the other ways in still work. Sent once per pause. It names the way that was used and what to do if it wasn’t you.
The password on your Driftstack account was removed	A sign-in link was the first confirmation of the account’s email address, and the account had a password — set before the address was confirmed — so the password was removed. Sent once. Set a new one with a password reset.
Two-factor sign-in is now on for your Driftstack account	Two-factor sign-in was turned on for the account. Sent every time, so you hear about it if it wasn’t you.
A sign-in method was removed from your Driftstack account	A linked Google or GitHub sign-in was removed from the account’s security page. If it wasn’t you, reset your password.

The send-triggering endpoints are IP-rate-limited (3 requests per minute per IP for resend-verification, password-reset, and magic-link requests), so a double-clicked button won’t lock you out — but a script hammering them will get 429s.

Each kind of these emails also reaches one mailbox at most 5 times an hour and 10 times a day, whoever asks. Past that the request is still answered “sent”, so the reply never says anything about the address, but no email goes out; the link already in the inbox keeps working until it expires.

Getting started

Opt-outable lifecycle emails.

Email	Trigger
Welcome to Driftstack	Sent once, after email verification succeeds.
Your first session is up	The account’s first successful session — a one-time activation milestone.
Your first session failure	The account’s first failed session, with pointers for debugging it.

Billing

Email	Trigger	Opt-outable?
Payment receipt	A successful subscription charge (Stripe’s `invoice.payment_succeeded`). Zero-amount invoices — trial starts, 100% discounts — don’t produce one.	Yes
Payment failed	A subscription charge fails (`invoice.payment_failed`) while the payment can still be made. Says that new sessions and AI are stopped until the payment goes through (there is no grace period), links to the open invoice to pay now, and says when the automatic retry happens (or, when the bank asks you to confirm the payment, that you need to open the invoice to confirm it; or, when no automatic retry is scheduled, that paying the open invoice restores access). For a checkout’s first payment, or a subscription you cancelled yourself or replaced with another plan, nothing is paused: it links the invoice and says whether a retry is scheduled, without the paused-access line.	No
Your subscription has ended	The automatic payment retries of a subscription are over and Driftstack has ended it (Terms §8.5). Sent once per subscription, whichever event ended it. Says the subscription has ended, your profiles, proxies and settings are kept, and you can choose a plan again in Billing (with a link to Billing; the open invoice was voided, so there is no pay link). Not sent when another subscription of yours already gives you a plan.	No
Subscription tier changed	Your tier changes (upgrade or downgrade).	Yes
Your subscription renews in 7 days	Stripe’s upcoming-invoice notice, roughly 7 days before a renewal charges.	Yes
Your plan ends soon	A plan paid with crypto ends in 7 days or less and nothing follows it (crypto payments don’t renew on their own). Names the plan, the end date (UTC) and links to the billing page to renew. Not sent while a card subscription is active, or when a later crypto payment continues the plan.	No
Your plan ends within a day	The same plan ends in a day or less. Sent once, as the last warning; if the first warning was missed (less than 7 days were left when it was paid), only this one is sent.	No
Your crypto payment is not complete	A crypto order was paid only in part. Says what arrived, what is still owed and by when (3 days), and to send the rest to the same address in the same coin. Sent again if a later part payment still leaves it short; not sent for a repeated notification of the same payment.	No

Stripe (the card processor) may send its own processor receipt in addition to the Driftstack one, depending on your Stripe email settings. Crypto orders don’t email receipts — download them from the dashboard, under Billing → Crypto payments.

AI credits

Sent only where your plan’s AI credits are in use, once per billing period each. Opt-outable as ai-credits-usage.

Email	Trigger	Opt-outable?
You have used 80% of this period’s AI credits	Your account has used 80% of the AI credits your plan includes for the current period.	Yes
Your AI credits for this period are used up	No credit left on your account can start an AI task, so the AI agent pauses.	Yes

Team

Email	Trigger	Opt-outable?
You’re invited to join a Driftstack team	The account owner invites a member. The link is single-use and required to accept, so this always sends.	No

Security + credential rotation

Security advisories — never opt-outable.

Email	Trigger
Rotate your webhook signing secret	A webhook signing secret reaches the 60-day reminder threshold (the recommended rotation cadence is 90 days).
Your webhook secret was auto-rotated for security	NOT CURRENTLY SENT — automatic rotation is not enabled on this deployment, so no secret is rotated at the 91-day mark and this email cannot arrive. Rotate on your own cadence via `POST /v1/webhooks/{id}/rotate-secret`. If automatic rotation is turned on, this email carries the 7-day dual-signing grace deadline for rolling out the new secret.
Webhook secret grace window expires in 24h	Sent inside the final ~24 hours of a rotation grace window if your verifier hasn’t picked up the new secret yet. A grace window opens whenever a secret is rotated — today that means a rotation you request, since automatic rotation is not enabled.
Rotate your Anthropic API key	A stored BYOK Anthropic key reaches the 60-day reminder threshold. The key itself never appears in the email.
Your account will be deleted unless you choose a plan	The trial deletion sweep (Terms of Service §8.9(3)): the account’s free trial ended 30 days ago and no plan has been chosen. Sent once per account; it names the day the account may be deleted, seven days later, and links the plan picker. Choosing a plan at any time stops the deletion. Never opt-outable: it is the notice the Terms promise.
Your subscription is paused	You paused your subscription (in the billing portal) and the period you had already paid for has ended. Until then the plan keeps running; from then sessions can’t start while it is paused. It says where to manage it: the Stripe portal from your dashboard’s Billing page, or support. Your profiles, proxies and settings are kept. Never opt-outable: it tells you your access stopped.

Status-page notifications

These go to status.driftstack.io subscribers — a separate opt-in list, not tied to your account’s email preferences. Every status email carries an unsubscribe link.

Email	Trigger
Confirm your Driftstack status updates	Submitting the subscribe form on the status page — clicking the link is the opt-in confirmation (double opt-in).
You’re subscribed to Driftstack status	Sent once after the confirmation click.
Incident posted	A public incident is filed.
Incident update	Driftstack posts an update on an open incident. Throttled to at most one per subscriber per incident per hour.
Incident resolved	The incident is resolved. One subscription covers posted + update + resolved.

Support

A fixed acknowledgement may be sent automatically; it comes from the address you wrote to, on the @driftstack.dev mail domain even if you wrote to driftstack.io, except that a message to an address we only send from is acknowledged from [email protected]. Not every message gets one: an acknowledgement goes only to a sender whose message passes email authentication (DKIM and DMARC), at most once per sender every few days, and never in reply to automatic mail (bounces, out-of-office replies, mailing lists). They are not opt-outable: they answer a message you sent us. Every other reply from support is read and approved by a person before it is sent, and comes from [email protected], or from the address you wrote to.

Email	Trigger
We received your security report	A message to `[email protected]` that meets the conditions above; not every message gets one. It is the automated acknowledgement our disclosure policy says you may receive. A person replies within one business day.
We received your privacy request	A message to `privacy@` or `[email protected]`. Carries a request reference and the date by which we answer (one month under the GDPR).
We received your reply to our sub-processor notice	A reply to our notice about a new sub-processor, sent to `[email protected]`. Carries a request reference; a person reads it and answers under the objection terms in section 3.4 of the DPA.
We received your urgent message	A message to `[email protected]`.
This address isn’t monitored — we passed your message to support	A reply to `noreply@`, `status@` or `[email protected]`, addresses we only send from. Your message reaches support; you don’t need to resend it.
We received your abuse report	A message to `[email protected]`. We triage within five business days and never share details about any account with the reporter.

Managing your preferences

The opt-outable categories are controlled per event type in the dashboard’s Settings → Email toggles.

You can opt out of these event types: signup-welcome, session-success-first, session-failed-first, tier-changed, billing-receipt, billing-renewal-reminder, and — where AI credits are in use — ai-credits-usage. Every other email is operational and always sends.

Didn’t get an email?

Work through these in order before contacting support:

Check the exact address you typed. Aliases (user+driftstack@…), corporate filters, and dot-stripping rules are common reasons a legitimate send lands somewhere unexpected. Search for from:[email protected].
Check spam / junk / Promotions. Mark Driftstack as “not spam” and add [email protected] to your contacts so future sends route to the inbox.
Wait a minute, then re-trigger. Postmark typically delivers in seconds, but recipient-side queues add latency. Sign-in and verification emails are safe to re-request — an earlier link keeps working until it expires (using any one retires the rest), and the 3/minute per-IP cap tolerates a retry.
On a work address? Some workspaces quarantine mail from new senders until an admin releases it. @driftstack.dev is the mail domain to allowlist.
Repeated silence on the same address usually means a typo’d domain or a hard bounce: bounced addresses land on a suppression list that mutes every retry. Email [email protected] from a different address, mention the original one, and we’ll check the delivery log, clear the suppression, and replay the send.

When you contact support, include the address the email was sent to, the action that triggered it, and an approximate timestamp with timezone — that’s what we match against the delivery log.