Skip to main content

Email

All email goes through AWS SES from notifications@mail.oncoeverything.com. The sender is in apps/api/src/mailer.ts, and the templates are React Email components in apps/api/src/emails.
  • SES verifies the domain with DKIM. SPF and DMARC records are in Route 53, from infra/email.tf.
  • DMARC is at p=none for now. Move it to quarantine, then reject, when the DMARC reports are clean.
  • New staff requests go to REQUEST_NOTIFY_EMAIL, which is hello@oncoeverything.com.
  • Locally, when MAIL_FROM is not set, the API prints each email to its console instead of sending it.
SES production access was requested in September 2026. Until AWS grants it, SES sends only to verified addresses, 200 a day. Check the status in the SES console under Account dashboard.
Staff can see every email template at /internal/emails on the site.

Card payments

Stripe takes the card on its own hosted page. Card details never reach the platform.
1

The buyer clicks Buy this report

The API creates a Stripe Checkout session and sends the buyer to Stripe.
2

Stripe calls the webhook

Stripe posts to the API’s /webhooks/stripe. The API checks the signature and records the event in stripe_events, so the API processes a repeated event only once.
3

The API fulfills the order

It creates a paid invoice, grants access to the report, queues a copy and sends the receipt.
The webhook listens for these events:
  • checkout.session.completed
  • checkout.session.async_payment_succeeded
  • checkout.session.async_payment_failed
  • checkout.session.expired
Payments turn on when STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET are in the app secret. Until then, Buy this report opens the inquiry form and the webhook answers 404. Invoices paid by bank transfer do not go through Stripe. Staff record those payments by hand. See Invoices.