Security & Compliance

1. Our Commitment to Security

As an enterprise email delivery platform handling millions of messages daily, we understand the critical importance of protecting our clients' data and maintaining the highest standards of security and compliance.

2. Data Protection

2.1 Our Commitment

Way2Mail is committed to protecting all data entrusted to us by our clients. This includes client account data, email content, recipient information, delivery metadata, and any other information processed through our platform. We treat all client data as confidential and apply appropriate safeguards at every stage of the data lifecycle.

2.2 Data We Process

In the course of providing our services, Way2Mail may process the following categories of data:

• Client Account Data: Information provided during onboarding, such as business name, contact details, billing information, and domain configuration details.
• Email Content: The subject lines, body content, and attachments of emails sent through the Way2Mail platform.
• Recipient Data: Email addresses and any associated identifiers provided by the client for the purpose of email delivery.
• Delivery & Performance Data: Logs, delivery receipts, bounce information, open/click tracking data, and other metadata generated during the delivery process.
• Technical Data: IP addresses, API keys, authentication tokens, and system logs related to the client's use of the platform.

2.3 Purpose Limitation

Way2Mail processes client data solely for the following purposes:

• To deliver emails on behalf of the client as instructed.
• To provide delivery reporting, analytics, and troubleshooting support.
• To maintain and improve the security, reliability, and performance of our platform.
• To comply with applicable legal obligations.

2.4 Data Minimisation

We collect and retain only the minimum data necessary to fulfil our service obligations. We do not request or store data that is not directly relevant to the provision of our email delivery services.

3. Data Retention & Deletion

3.1 Retention Approach

Way2Mail retains client data for the duration of the client's active subscription. The following outlines our general retention approach, which may be adjusted by mutual agreement under a Data Protection Agreement:

• Email Content & Recipient Lists: Retained for the duration of the active subscription. Deleted when the subscription ends or upon client request.
• Delivery Logs: Retained during the active subscription to support troubleshooting and analytics. Deleted when there is no active subscription.
• Account & Billing Data: Retained during the subscription period. After the subscription ends, billing records may be retained for a limited period for business and accounting purposes, after which they are permanently deleted.
• Security & Access Logs: Retained for audit and incident investigation purposes. Deleted when there is no active subscription.

3.2 Deletion & Disposal

Upon termination of a client's account, or upon written request, Way2Mail will permanently delete or irreversibly anonymise all client data, except where retention is required for legitimate business or legal purposes. Deletion is carried out using industry-standard secure erasure methods.

4. Data Sharing & Sub-Processors

Way2Mail does not sell, rent, or trade client data. We may share data only in the following limited circumstances:

• Infrastructure Providers: We use third-party data centre and cloud infrastructure providers to host our platform. These providers are contractually bound to maintain the confidentiality and security of data.
• Delivery Partners: In certain cases, we may route email through trusted delivery partners to optimise deliverability. Such partners process data solely for the purpose of delivery and are bound by confidentiality obligations.
• Legal Requirements: We may disclose data if required to do so by law, regulation, or valid legal process.

Where third-party providers are involved in processing client data, they are subject to appropriate contractual safeguards to ensure the confidentiality and security of that data.

5. Data Security

5.1 Encryption

• All data in transit is encrypted using TLS 1.2 or higher.
• STARTTLS is supported for SMTP connections, and HTTPS is enforced for all API and web traffic.
• All data at rest is encrypted using AES-256 encryption.

5.2 Access Controls

• Role-based access controls (RBAC) enforced with the principle of least privilege.
• Multi-factor authentication (MFA) mandatory for all internal systems.
• All access to client data is logged, monitored, and periodically audited.
• Employee access to production systems restricted to authorised personnel with background verification.

5.3 Infrastructure

• Enterprise-grade data centres with 24/7 physical security, biometric access, and CCTV surveillance.
• DDoS protection, firewall, and intrusion detection/prevention systems.
• Periodic vulnerability assessments, penetration testing, and timely patch management.

6. Incident Response & Breach Notification

Way2Mail maintains a formal incident response plan. In the event of a security incident that affects client data:

• We will notify affected clients without unreasonable delay after becoming aware of the incident.
• The notification will include the nature of the incident, the data affected, the likely consequences, and the measures taken to address it.
• We will cooperate with clients in investigating and remediating the incident.
• A post-incident review will be conducted and findings shared with affected clients upon request.

7. Client Rights & Responsibilities

7.1 Client Rights

Way2Mail's clients have the following rights with respect to their data:

• Right to Access: Clients may request a copy of the data Way2Mail holds on their behalf.
• Right to Correction: Clients may request correction of inaccurate data.
• Right to Deletion: Clients may request deletion of their data, subject to legitimate retention requirements.
• Right to Data Export: Clients may request an export of their data in a commonly used, machine-readable format.
• Right to Information: Clients may request details about how their data is processed, shared, and retained.

7.2 Client Responsibilities

Clients using Way2Mail's platform are responsible for:

• Ensuring they have obtained all necessary consents or permissions required to send emails to their recipients and to share recipient data with Way2Mail for processing.
• Providing accurate and up-to-date recipient data and maintaining proper list hygiene.
• Complying with all applicable laws and regulations governing their own email communications in their jurisdiction.
• Notifying Way2Mail promptly of any changes that may affect data protection obligations.

8. Data Protection Agreement

Way2Mail recognises that different clients operate under different regulatory frameworks and have unique data protection requirements. Rather than prescribing a single regulatory standard, Way2Mail is prepared to enter into a tailored Data Protection Agreement (DPA) with each client.

The DPA will set out the specific terms governing:

• The scope and purpose of data processing.
• Specific security measures and safeguards applicable to the client's data.
• Confidentiality obligations.
• Data retention and deletion timelines.
• Breach notification procedures.
• Third-party provider obligations.
• Audit rights and cooperation.
• Liability and indemnification.

Clients may request a DPA at any time — before or during their engagement. The specific terms and any associated costs will be mutually agreed upon by both parties.

9. Email Authentication & Anti-Abuse

Way2Mail supports and enforces industry-standard email authentication protocols:

• SPF: We configure SPF records for all client domains to authorise our sending IPs.
• DKIM: Every email is cryptographically signed to ensure message integrity and authenticity.
• DMARC: We assist clients in implementing DMARC policies to prevent domain spoofing.
• BIMI: Support for displaying verified brand logos in recipients' inboxes.

We maintain a strict zero-tolerance policy for spam and unsolicited email. Automated content scanning, ISP feedback loops, and continuous blacklist monitoring are in place to detect and prevent abuse.

10. Business Continuity & Disaster Recovery

• Platform designed for 99.9% uptime with automatic failover and load balancing.
• Regular automated backups with encrypted off-site storage.
• Documented incident response procedures with defined escalation paths.
• 24/7 infrastructure monitoring with automated alerting.

11. Vulnerability Management

• Periodic vulnerability assessments and penetration testing.
• Timely application of security patches based on risk assessment.
• Secure coding practices embedded in our development lifecycle.

We welcome responsible security disclosures. Contact Contact@way2mail.com to report a vulnerability.

12. Contact

For data protection inquiries, security concerns, or to request a Data Protection Agreement:

• Email: Contact@way2mail.com
• Phone: +91 8977728755