diff --git a/.env.example b/.env.example
index 4ebce08b5..57a20c7a6 100644
--- a/.env.example
+++ b/.env.example
@@ -1,8 +1,13 @@
 # Required
 AUTH_SECRET="" # openssl rand -base64 32
 DATABASE_URL="" # Format: "postgresql://postgres:pass@127.0.0.1:5432/comp"
-RESEND_DOMAIN=" # Domain configured in Resend, e.g. mail.trycomp.ai
+RESEND_DOMAIN="" # Domain configured in Resend, e.g. mail.trycomp.ai
 RESEND_API_KEY="" # API key from Resend for email authentication / invites
+RESEND_FROM_MARKETING="Lewis Carhart <lewis@mail.trycomp.ai>"
+RESEND_FROM_SYSTEM="Comp AI <mail@mail.trycomp.ai>"
+RESEND_FROM_DEFAULT="Comp AI <mail@mail.trycomp.ai>"
+RESEND_TO_TEST="mail@mail.trycomp.ai"
+RESEND_REPLY_TO_MARKETING="lewis@mail.trycomp.ai"
 REVALIDATION_SECRET="" # openssl rand -base64 32
 NEXT_PUBLIC_PORTAL_URL="http://localhost:3002" # The employee portal uses port 3002 by default
 
@@ -21,3 +26,4 @@ TRIGGER_SECRET_KEY="" # Secret key from Trigger.dev
 OPENAI_API_KEY="" # AI Chat + Auto Generated Policies, Risks + Vendors
 FIRECRAWL_API_KEY="" # For research, self-host or use cloud-version @ https://firecrawl.dev
 
+AUTH_TRUSTED_ORIGINS=http://localhost:3000,https://*.trycomp.ai,http://localhost:3002
diff --git a/apps/app/src/utils/auth.ts b/apps/app/src/utils/auth.ts
index 6c586f11d..5f133ea83 100644
--- a/apps/app/src/utils/auth.ts
+++ b/apps/app/src/utils/auth.ts
@@ -44,7 +44,7 @@ export const auth = betterAuth({
     provider: 'postgresql',
   }),
   baseURL: process.env.NEXT_PUBLIC_BETTER_AUTH_URL,
-  trustedOrigins: ['http://localhost:3000', 'https://*.trycomp.ai', 'http://localhost:3002'],
+  trustedOrigins: process.env.AUTH_TRUSTED_ORIGINS ? process.env.AUTH_TRUSTED_ORIGINS.split(",").map(o => o.trim()) : ['http://localhost:3000', 'https://*.trycomp.ai', 'http://localhost:3002'],  
   emailAndPassword: {
     enabled: true,
   },
diff --git a/packages/email/lib/resend.ts b/packages/email/lib/resend.ts
index af2de219f..adba3caa4 100644
--- a/packages/email/lib/resend.ts
+++ b/packages/email/lib/resend.ts
@@ -1,7 +1,6 @@
 import { Resend } from 'resend';
 
 export const resend = process.env.RESEND_API_KEY ? new Resend(process.env.RESEND_API_KEY) : null;
-export const domain = process.env.RESEND_DOMAIN ?? 'mail.trycomp.ai';
 
 export const sendEmail = async ({
   to,
@@ -26,18 +25,41 @@ export const sendEmail = async ({
     throw new Error('Resend not initialized - missing API key');
   }
 
+
+    // 1) Pull each env var into its own constant
+  const fromMarketing = process.env.RESEND_FROM_MARKETING;
+  const fromSystem    = process.env.RESEND_FROM_SYSTEM;
+  const fromDefault   = process.env.RESEND_FROM_DEFAULT;
+  const toTest        = process.env.RESEND_TO_TEST;
+  const replyMarketing= process.env.RESEND_REPLY_TO_MARKETING;
+
+  // 2) Decide which one you need for this email
+  const fromAddress = marketing
+    ? fromMarketing
+    : system
+      ? fromSystem
+      : fromDefault;
+
+  const toAddress = test ? toTest : to;
+
+  const replyTo = marketing ? replyMarketing : undefined;
+
+  // 3) Guard against undefined
+  if (!fromAddress) {
+    throw new Error('Missing FROM address in environment variables');
+  }
+  if (!toAddress) {
+    throw new Error('Missing TO address in environment variables');
+  }
+
   try {
     const { data, error } = await resend.emails.send({
-      from: marketing
-        ? `Lewis Carhart <lewis@${domain}>`
-        : system
-          ? `Comp AI <mail@${domain}>`
-          : `Comp AI <mail@${domain}>`,
-      to: test ? `mail@${domain}` : to,
+      from: fromAddress,      // now always a string
+      to: toAddress,          // now always a string
       cc,
-      replyTo: marketing ? `lewis@${domain}` : undefined,
+      replyTo,
       subject,
-      //@ts-ignore expected
+      // @ts-ignore – React node allowed by the SDK
       react,
       scheduledAt,
     });