anymail Trust Center
Welcome to the anymail Trust Center
Trust comes from knowing where your data lives, who can reach it and what we do with it. This page lists the frameworks we follow and the controls already in place. Our ISO 27001 certification is in progress, with the certification audit planned for January 2028.
Compliance
Where we stand against the frameworks that matter to a processor of business contact data.
ISO 27001
Certification in progress. Certification audit planned for January 2028.
In progressGDPR
GDPR compliant data processing. Application and database in Germany, no transfer outside the EEA for core processing.
CompliantData collected
What anymail stores when you use it. No card data and no health data is kept in anymail.
- Account data: name, email, hashed password, workspace name
- Connected mailbox data
- Prospect data: name, email, company, job title, custom fields
- Campaign content, replies and events (bounce, unsubscribe, send)
- Technical data: IP address, browser, logs
- Billing data: cards are handled by the payment processor, not by anymail
Controls
Implemented controls, grouped by area.
Infrastructure security
- Application and database hosted in Germany (Hetzner), in the EU
- No transfer outside the EEA for core processing
- Workspace data isolated by row-level security, tested
Organizational security
- Acceptable use policy applies to every account
- Privacy and security mailbox staffed by Meditium sp. z o.o.
- Vulnerability reports answered, reporters are not threatened
Product security
- Passwords stored hashed
- Mailbox credentials encrypted with AES-256 at rest, key held outside the database
- A credential value never reaches a page
- Webhooks signed with HMAC-SHA256
Internal security procedures
- Sending is throttled to protect shared reputation
- Suppression is honoured platform-wide
- Reply classification runs on a model key supplied by the customer, encrypted per workspace
Data and privacy
- Suppression list and workspace data exportable in one click
- Data deleted within 30 days of account closure
- No card data stored in anymail, payments handled by Stripe
- Data Processing Agreement available
Subprocessors
Third parties that process data on our behalf. The full list and terms are in the DPA.
| Subprocessor | Role | Location |
|---|---|---|
| Hetzner | Server hosting, database | Germany |
| Cloudflare | DNS and network security | Global network, EU data residency where configured |
| vh.net.pl (Nodea) | Email hosting for anymail.watch addresses | Poland (EU) |
| Google (Gmail) | Team inbox that receives notifications about programme applications | Global |
| Customer mail provider | Sending and receiving, per the mailbox the customer connects | Depends on the provider chosen by the customer |
| Stripe Payments Europe, Ltd. | Payments | Ireland |
FAQ
Want to report a potential security issue?
Write to privacy@anymail.watch. We answer every report, and we do not threaten people who tell us about holes.
What does anymail deliver, and how is it deployed?
anymail is a cold email platform that counts outreach and offers per company. It runs as a hosted web application: the application and the database in Germany, in the EU. Customers connect their own mailboxes (Gmail, Microsoft 365, SMTP, IMAP).
How is data protected when it travels between my device and the service?
The website and the app are served over HTTPS, so traffic between your device and anymail is encrypted in transit. Mailbox credentials are also encrypted at rest with AES-256. For details such as TLS versions, ask privacy@anymail.watch.
Updates
ISO 27001 audit planned January 2028
The ISO 27001 certification audit is planned for January 2028. Questions about security or privacy: privacy@anymail.watch.