Security policy

Data encryption and protection

We implement multiple layers of encryption to protect your data:

• Data in transit. All communications use TLS 1.3 encryption with perfect forward secrecy
• Data at rest. AES-256 encryption for all stored data with hardware security modules (HSMs)
• Key management. Industry-standard key rotation and secure key storage practices
• End-to-end protection. Email content is encrypted in transit and discarded after analysis, not stored
• Database security. Encrypted database connections with field-level encryption for sensitive data

Our encryption standards exceed industry requirements and are regularly audited by third-party security firms.

Infrastructure security

Our platform is built on secure, enterprise-grade infrastructure:

• Cloud security. SOC 2 Type II compliant cloud infrastructure with 99.9% uptime SLA
• Network security. Multi-layered firewalls, DDoS protection, and intrusion detection systems
• Server hardening. Minimal attack surface with regular security updates and patching
• Geographic distribution. Global data centers with automatic failover and disaster recovery
• Monitoring and logging. 24/7 security monitoring with real-time alerts and comprehensive audit logs

Our infrastructure is hosted in secure data centers with physical security controls and biometric access.

Access controls and authentication

Strict access controls protect our systems and your data:

• Multi-factor authentication. Required MFA for all user accounts and administrative access
• Role-based access. Principle of least privilege with granular permission controls
• Session management. Secure session handling with automatic timeout and logout
• API security. Rate limiting, authentication tokens, and request validation
• Employee access. Background checks, security training, and regular access reviews for all staff

Administrative access is logged, monitored, and requires approval through our change management process.

Threat detection and response

Advanced threat detection protects against evolving security risks:

• Real-time monitoring. AI-powered anomaly detection and behavioral analysis
• Incident response. Dedicated security team with 24/7 response capabilities
• Threat intelligence. Integration with global threat feeds and security research
• Vulnerability management. Regular penetration testing and security assessments
• Security operations center. Continuous monitoring by certified security professionals

We maintain incident response procedures with notification requirements meeting GDPR and other regulatory standards.

Data privacy and retention

We minimize data collection and implement strict retention policies:

• Data minimization. We only collect data necessary for our phishing detection services
• Automatic deletion. Emails you scan are not stored; one you attach to a feedback report is kept until it has been reviewed
• Metadata retention. Signed-in analyses keep the sender, recipient, subject and verdict until the account is deleted; login-free scans keep none
• Secure deletion. Cryptographic erasure ensures data cannot be recovered
• Privacy by design. Security and privacy controls built into every system component

Our privacy practices exceed GDPR requirements and are regularly audited for compliance.

Security testing and audits

Regular testing ensures our security measures remain effective:

• Penetration testing. Quarterly testing by independent security firms
• Code reviews. Mandatory security reviews for all code changes
• Vulnerability scanning. Automated daily scans of all systems and applications
• Compliance audits. Annual SOC 2 and ISO 27001 compliance audits
• Bug bounty program. Responsible disclosure program for security researchers

All security findings are addressed according to our risk-based remediation process.

Employee security training

Our team receives comprehensive security training:

• Security awareness. Mandatory monthly security training for all employees
• Phishing simulation. Regular phishing tests to maintain awareness levels
• Incident response training. Specialized training for security team members
• Compliance training. Regular updates on privacy laws and regulatory requirements
• Security certifications. Support for professional security certifications (CISSP, CISM, etc.)

Security standards and compliance readiness

We implement industry-leading security frameworks and maintain readiness for major compliance standards.

• SOC 2 type II. Audit readiness
• ISO 27001. Framework implementation
• GDPR. Compliance ready

Security incident response

Our dedicated security team responds to incidents 24/7 with established procedures.

Report security issues

• Email: [email protected]
• Response: Within 4 hours

Security team contact

Have security questions or want to report a vulnerability? Our team is here to help.