Security and data
A security product should be clear about its own security
This page explains what data FlashFortify processes, where it's kept and how access to it is protected.
What we process
DMARC aggregate reports only. These contain:
- The IP addresses of servers that sent email using your domain
- Message counts
- SPF, DKIM and DMARC results, and the policy applied
They don't contain email content, subject lines or the people who received the email.
What we don't request
We don't ask for DMARC forensic (failure) reports. These can include message headers and personal data, and most organisations don't need them to reach a reject policy.
Where it's kept
- Reports are received and stored in Amazon Web Services' London region (eu-west-2)
- Raw report emails are deleted automatically after 30 days; the analysed results are kept for your reporting history
- Incoming report emails are virus-scanned and must pass sender authentication before they're processed
Who can see it
- Each organisation's data is separate
- Every user signs in with multi-factor authentication
- Owner, admin and viewer roles limit who can change what
- Sign-ins and changes are recorded in an activity log you can review
- Sessions end after 30 minutes of inactivity
How we build it
- Report files are treated as untrusted input and parsed with protections against oversized and malicious files
- Every result comes from deterministic rules that you can see, not from automated guesswork
- Access keys are kept out of source code and limited to what each component needs
- Automated tests cover the parsing, scoring, alerting and sign-in rules
Questions from your security team?
We're happy to answer supplier security questionnaires. Get in touch.