Security & Compliance

Every record in the platform belongs to an organization. Access is enforced at the database layer through row-level security policies, so a query issued by one organization can never read another organization's leads, campaigns, mailboxes or analytics.

Production, staging and development environments are fully separated, with no production data used in non-production environments.

All traffic is served over TLS 1.2 or higher with modern cipher suites and HSTS. Data at rest is encrypted with AES-256. OAuth tokens, SMTP credentials and API keys are encrypted with separately managed keys and are never returned to the browser after creation.

Workspace access uses email and password with optional multi-factor authentication; Enterprise plans support SSO via SAML and SCIM provisioning. Roles are stored separately from user profiles and evaluated server-side, so permissions cannot be escalated from the client.

Internal access follows least privilege, is granted just-in-time, reviewed quarterly, and logged. Production access requires MFA and is limited to a small on-call group.

All input is validated server-side. We use parameterised queries, output encoding and a strict content security policy. Dependencies are scanned continuously and patched on a risk-based SLA: critical within 48 hours, high within 7 days.

We conduct periodic third-party penetration tests and remediate findings on a tracked schedule. A summary report is available under NDA.

The platform targets 99.9% monthly availability, contractually committed on Enterprise plans. Databases are backed up daily with point-in-time recovery, backups are encrypted, and restore procedures are tested at least twice a year.

As a processor, we process Customer Data only on your documented instructions to provide the Service. Processing categories include lead contact details, email content, mailbox metadata and engagement events. Data subjects include your prospects and your Authorized Users.

Sub-processors cover hosting, email infrastructure, verification, AI inference, analytics, payments and support. Each is contractually bound to equivalent protection standards, and we maintain a current list available on request.

AI features send only the context required to produce an output — such as prospect company, role and prior thread content — to our model providers. Your Customer Data is not used to train shared or third-party models, and outputs are returned to your workspace only.

Our controls are aligned to SOC 2 Trust Services Criteria and ISO 27001 practices, covering change management, incident response, vendor risk and access review. We support GDPR and India's DPDP Act obligations, including DPAs, Standard Contractual Clauses for international transfers, and data subject request handling.

We maintain a documented incident response plan with defined severity levels, an on-call rotation and post-incident reviews. Confirmed personal data breaches are reported to affected customers without undue delay and within the timelines required by applicable law.

Report suspected vulnerabilities to legal@sendemail.tech with reproduction steps. We acknowledge within two business days, will not pursue legal action for good-faith research, and credit researchers who request it after a fix ships.