Security

Effective date: 2026-09-25

This page describes the technical and organizational measures Irisend ("Irisend") applies to protect Customer Content and account data. It supplements, and does not replace, the security commitments in our Data Processing Agreement (Annex II, Technical and Organizational Measures).

1. Infrastructure

• Hosting: The Irisend API, worker, and dashboard run on a self-hosted Coolify platform on dedicated infrastructure provided by OVH (server [to be completed: SERVER_IP], [to be completed: OVH_DATACENTER_LOCATION]). Email sending itself is delegated to Amazon SES in [to be completed: AWS_REGION].
• Network protection: Public traffic is proxied through Cloudflare, providing DDoS mitigation, TLS termination, and a web application firewall in front of the marketing site and dashboard.
• Isolation: Production, staging, and development environments are logically separated. Database access is restricted to internal services and to operators via authenticated, audited access only.

2. Encryption

• In transit: All API, SMTP, and dashboard traffic is encrypted using TLS 1.2+ (SMTP submission enforces STARTTLS/implicit TLS). HSTS is enabled on the dashboard and marketing site.
• At rest: Database volumes and backups are encrypted at rest. API keys and SMTP credentials are stored using salted, one-way hashes; secrets and credentials for infrastructure are stored in a secrets manager, not in source control.

3. Access Control

• Least privilege: Internal access to production systems and Customer Content is limited to personnel who need it to operate or support the Service, and is logged.
• Authentication: Employee access to production infrastructure requires unique credentials and, where supported, multi-factor authentication (MFA). Customer dashboard accounts support strong password requirements and (where enabled) MFA.
• API keys: Customers can issue scoped API keys (e.g., sending-only vs. full access) and revoke them at any time from the dashboard.

4. Application Security

• Dependencies and container images are kept up to date and monitored for known vulnerabilities.
• Changes to production go through code review before deployment.
• Input validation and standard web-application protections (CSRF protection, output encoding, parameterized database queries) are applied throughout the API and dashboard.

5. Monitoring and Logging

• Access logs, API request logs, and error logs are retained for security monitoring and troubleshooting, consistent with the retention periods described in our Privacy Policy and DPA.
• We monitor sending patterns, bounce/complaint rates, and anomalous account activity as part of our Acceptable Use enforcement and account-security processes.

6. Backups and Availability

• Database backups are taken on a regular schedule, encrypted, and stored separately from the primary environment, with periodic restore testing.
• Infrastructure and dependency configuration is version-controlled to support recovery and consistent redeployment.

7. Incident Response

• We maintain an internal process to detect, triage, and respond to security incidents.
• In the event of a security incident that constitutes a personal data breach affecting Customer Content, we will notify affected Customers without undue delay and, in any event, within the timeframe required under our DPA (generally without undue delay after becoming aware, to enable Customer's own regulatory notification obligations, e.g., the 72-hour window under GDPR Art. 33 where applicable), including known details of the incident, likely consequences, and mitigation steps taken.

8. Subprocessor Security

We select subprocessors (AWS, OVH, Cloudflare, Stripe — see Subprocessors) based in part on their security posture and contractual commitments, and require data-protection agreements consistent with GDPR Art. 28 where they process personal data on our behalf.

9. Vulnerability Reporting

If you believe you've found a security vulnerability in Irisend, please report it responsibly to [to be completed: SECURITY_EMAIL] (or legal@irisend.dev). Do not access or modify data that isn't yours, and give us a reasonable opportunity to investigate and remediate before public disclosure. We do not currently operate a paid bug-bounty program; this may be added later ([to be completed: BUG_BOUNTY_URL]).

10. Compliance Roadmap

Irisend does not currently hold third-party security certifications (e.g., SOC 2, ISO 27001). This is a roadmap item — see the checklist in research/legal.md. This page will be updated to reflect any certifications obtained, and audit reports will be made available under NDA to Customers on eligible plans upon request.

11. Contact

Security questions or reports: [to be completed: SECURITY_EMAIL]. General questions: legal@irisend.dev.

---

This document is a draft template and does not constitute legal advice. See research/legal.md for review recommendations before publishing.