Security, Privacy & Compliance
Security and privacy that match the trust your email carries.
Email is the front door of your business. The infrastructure behind it should be governed, monitored, and honest about how it handles your data.
We never read message content
Egressif does not access or store email bodies or mailbox contents. Our operational access is limited to provisioning, configuration, aggregate logs and metrics, and account status.
Owned network and IP space
We operate our own ASN and IP space and run a resilient, multi-node mail server cluster designed for high availability. Your mail does not depend on infrastructure we can’t see into.
SOC 2-aligned providers and practices
We build on SOC 2-aligned providers and follow SOC 2-aligned practices: encryption in transit and at rest where applicable, least-privilege access, MFA, key management, and continuous monitoring.
Least-privilege integrations
When you connect Google Workspace or Microsoft 365, we request only the permissions needed for domain and mailbox administration. Tokens are encrypted at rest and deleted after revocation.
Responsible use, enforced
We maintain and enforce a clear acceptable-use policy. Unsolicited bulk email, purchased or harvested lists, and deceptive sending are prohibited across our network. That protection is part of why mail from Egressif is trusted.
Standards and compliance support
We operate to mailbox-provider sender requirements (including Gmail, Yahoo, and Microsoft bulk-sender rules) and support our clients’ obligations under CAN-SPAM, GDPR/UK GDPR, CCPA/CPRA, CASL, and KVKK. Clients remain the controller and sender of their mail.
Incident commitment
Material security incidents affecting the services or client data we process are reported without undue delay, and in any event within seventy-two (72) hours, including known scope and remediation steps.
Abuse reports, DNC and DNP: honored
Abuse reports are investigated and acted on promptly (report via our Report Abuse page or [email protected]). Do-not-contact (DNC) and do-not-prospect (DNP) requests are enforced as suppression at the delivery gate itself, beneath every client application, so an honored request cannot be overridden by an upstream mistake.
Infrastructure
The foundation under the promises.
Our own network and IP space
We run our own ASN and control our own IP ranges. Your sending reputation lives on infrastructure we govern directly, not on a rented corner of somebody else’s network.
A resilient, multi-node cluster
Mail flows through a multi-node cluster of mail servers built for high availability. A node can fail. Delivery keeps going.
End-to-end ownership
We own and operate the full stack from the network up. Fewer seams, faster fixes, and one team that answers for the outcome.
API access to everything
Manage domains, mailboxes, and sending programmatically, and consume delivery events the same way. Egressif fits into your systems instead of forcing you into ours.
Security taken seriously
We build on SOC 2-aligned providers, encrypt data in transit and at rest where applicable, and enforce least-privilege access with MFA. We never access your message content.
Deliverability best practices
We operate to current mailbox-provider sender requirements and email authentication standards: SPF, DKIM, DMARC alignment, TLS, and reverse DNS.
Questions about security or compliance?
Talk to us. We'll answer plainly, including the things vendors usually dodge.