Security and data handling
Monitoring your mail should not create a new risk. We read public DNS and reports you choose to send us, and we keep as little as we can.
Checks are DNS only
Blacklist, SPF, DKIM, DMARC, MX, PTR, BIMI, MTA-STS and TLS-RPT checks are DNS queries against public records. We never send mail from your domain and never need your mail server credentials.
DMARC reports go to a dedicated address
Each workspace gets its own reporting address for DMARC aggregate reports. Reports are parsed into sources and counts. The raw files are kept only for the history period of your plan.
Reputation connections are read-only
Mailbox provider reputation data is connected through read-only access that you grant and can revoke at any time from your account or from the provider.
Encryption in transit and at rest
All traffic uses TLS. Databases and backups are encrypted at rest. Webhook payloads are signed so you can verify they came from us.
Roles and client viewers
Owners, admins, members and read-only client viewers. Agencies can give a client access to one workspace without exposing the others.
SSO and audit log
The Scale plan adds SAML single sign-on and an audit log of every change to domains, alerts, users and billing.
Your data, your call
Deleting a domain removes its history. Deleting the workspace removes everything, including stored reports, within 30 days of backups rotating.
Responsible disclosure
Found a security issue? Write to [email protected] with the details. We reply within two business days and fix confirmed issues with priority.
More detail is in the privacy policy. Developers can read the API and webhook reference.