Security & Data Protection

At CalimaticMail, security is not an afterthought. We implement industry-leading security measures to protect your data and maintain your trust.

Security Measures

Encryption at Rest

All stored data is encrypted using AES-256 encryption, ensuring your emails and attachments remain secure.

Encryption in Transit

All data transmitted to and from our servers uses TLS 1.3, the latest security protocol.

Secure Infrastructure

Our infrastructure is hosted in SOC 2 compliant data centers with physical security controls.

Access Controls

Strict role-based access controls ensure only authorized personnel can access systems.

Regular Audits

We conduct regular security audits and penetration testing to identify and address vulnerabilities.

Employee Training

All employees undergo security awareness training and background checks.

DDoS Protection

Multi-layer DDoS protection ensures service availability even during attacks.

24/7 Monitoring

Continuous monitoring and alerting for security events and anomalies.

Data Processing Agreement (DPA)

1. Scope and Purpose

This Data Processing Agreement ("DPA") forms part of our Terms of Service and governs the processing of personal data by CalimaticMail on behalf of our customers ("Data Controllers").

2. Definitions

  • Personal Data: Any information relating to an identified or identifiable natural person
  • Processing: Any operation performed on personal data
  • Data Controller: The entity that determines the purposes and means of processing
  • Data Processor: CalimaticMail, processing data on behalf of the Controller

3. Processing Instructions

CalimaticMail will only process personal data in accordance with documented instructions from the Data Controller, unless required by law. Processing activities include:

  • Storing and transmitting email messages
  • Processing email metadata for delivery and analytics
  • Backup and disaster recovery operations
  • Security scanning and spam filtering

4. Security Measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

  • Encryption of personal data at rest and in transit
  • Ensuring ongoing confidentiality, integrity, and availability
  • Regular testing and evaluation of security measures
  • Incident response and disaster recovery procedures

5. Sub-processors

We may engage sub-processors to assist in providing our services. We maintain a list of current sub-processors and will notify you of any changes. Current sub-processors include:

  • Cloud infrastructure providers
  • Payment processors
  • Customer support tools

6. Data Subject Rights

We will assist you in responding to data subject requests, including:

  • Access to personal data
  • Rectification of inaccurate data
  • Erasure of personal data
  • Data portability
  • Objection to processing

7. Data Breach Notification

In the event of a personal data breach, we will notify you without undue delay (within 72 hours) and provide all necessary information to comply with your notification obligations.

8. Data Deletion

Upon termination of services, we will delete or return all personal data within 30 days, unless retention is required by law.

9. Audit Rights

Upon reasonable notice, we will make available information necessary to demonstrate compliance with this DPA and allow for audits conducted by you or an appointed auditor.

10. International Transfers

For transfers of personal data outside the EEA, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs)
  • Adequacy decisions where applicable

Compliance & Certifications

GDPR Compliance

We are fully compliant with the General Data Protection Regulation, ensuring proper handling of EU citizen data.

SOC 2 Type II

Our infrastructure providers maintain SOC 2 Type II compliance for security, availability, and confidentiality.

ISO 27001

We follow ISO 27001 standards for information security management systems.

HIPAA Ready

Enterprise customers can request HIPAA-compliant configurations with a Business Associate Agreement.

Have Security Questions?

Our security team is available to answer any questions about our security practices or to discuss your specific requirements.

Contact Security Team