Legal

    Security policy

    Version 2.0Updated July 25, 2026

    An email platform holds one of the most valuable assets a business owns: its audience. This page describes, concretely, how we protect the data you entrust to us. The service is owned and operated by CMC, Bredagervej 49, 2770 Kastrup, Denmark.

    Infrastructure

    The platform runs on Supabase (PostgreSQL) with content delivery and edge security by Cloudflare, and email delivery through Amazon SES.

    • Encryption at rest. All data is encrypted at rest using AES-256.
    • Encryption in transit. All connections use TLS 1.2 or higher.
    • EU data residency. Subscriber data is stored and processed in EU data centers.
    • Certified providers. Our infrastructure providers maintain independent certifications, including SOC 2 Type II (Supabase) and ISO 27001 (Amazon Web Services).
    • DDoS protection. Cloudflare provides network-level protection and filtering in front of the platform.

    Tenant isolation

    Every table in our database carries row-level security policies. Account separation is not an application convention that a bug can bypass - it is enforced at the database layer on every single query.

    Authentication and access

    • Passwords are stored as secure bcrypt hashes and are never available in plain text.
    • Sessions use short-lived tokens with automatic refresh.
    • API keys are scoped to the access they need (for example read-only), can be revoked instantly, and are stored as hashes - we cannot read them back, and neither can anyone else.
    • Integration credentials (such as e-commerce or sending credentials) are stored encrypted in a vault, with keys held outside the database.
    • Audit logging. Sensitive operations are logged for accountability.
    • Least privilege. Access to production systems is restricted to what is strictly necessary.

    Application security

    • All user input is validated, and database access uses parameterized queries to prevent SQL injection
    • User-generated HTML is sanitized before rendering to prevent cross-site scripting
    • Rate limiting protects authentication and API endpoints against abuse

    Email security

    • Authentication. Emails are sent with DKIM signatures, SPF and DMARC support on your own domain, with guided DNS setup and live verification.
    • Signed links. Unsubscribe and web-version links carry HMAC-SHA256 signatures, so they cannot be forged or enumerated. Web versions of emails expire after 180 days.
    • Bounce and complaint handling. Bounces and complaints stream back in real time and hard bounces are suppressed automatically, protecting your sender reputation.
    • Bot filtering. Security scanners and prefetch bots are detected and excluded from open and click statistics.
    • One-click unsubscribe. Emails include RFC 8058 one-click unsubscribe headers, and unsubscribes take effect immediately.

    Incident response

    We monitor the platform continuously and maintain documented procedures for handling security incidents: detection and alerting, containment, communication with affected customers, and recovery. If we become aware of a personal data breach affecting you, we will notify you without undue delay, as described in our GDPR compliance page.

    Vulnerability management

    Systems and dependencies are kept up to date with security patches, and we welcome responsible disclosure: if you believe you have found a security vulnerability, please report it to support@mailingplatform.net and we will respond within 2 business days. Please do not access or modify data that is not yours while researching.

    Compliance

    The platform is designed to support your compliance with the GDPR and applicable anti-spam legislation, including the ePrivacy rules, CAN-SPAM and CASL. See our GDPR compliance page and privacy policy for details.

    Contact

    Security questions or reports: support@mailingplatform.net