Security at Sendbound

1. Security Overview

Security is not a feature — it is the foundation of Sendbound. We are entrusted with the email communications and contact data of thousands of businesses, and we treat that responsibility with the highest level of seriousness. Our security program is built on a defence-in-depth model, spanning physical infrastructure, network controls, application-level protections, and rigorous personnel practices.

Our security posture is independently verified through third-party audits, continuous automated scanning, and an active vulnerability disclosure programme. We do not wait for incidents — we build, test, and iterate our controls on a continuous basis.

This page describes our controls at a high level. Enterprise customers may request our full security package (SOC 2 Type II report, pen test executive summary, completed security questionnaire) under NDA by contacting security@sendbound.com.

2. Certifications & Compliance

Sendbound is independently audited against the following frameworks:

SOC 2 Type II

Our SOC 2 Type II audit is conducted annually by an independent AICPA-accredited auditor and covers the Security, Availability, and Confidentiality trust service criteria. The audit covers a 12-month period and tests not just the design of controls, but their operational effectiveness over time. Reports are available to Enterprise customers under NDA.

GDPR & International Privacy Laws

Sendbound is designed to support customer compliance with the GDPR (EU), UK GDPR, Swiss FADP, CCPA, and other applicable data protection frameworks. We act as a Data Processor on behalf of our customers and provide a Data Processing Addendum (DPA) on request. See our DPA and GDPR page for details.

3. Infrastructure Security

Cloud Provider

Sendbound runs on Amazon Web Services (AWS) in multiple regions (us-east-1, eu-west-1, ap-southeast-1). AWS maintains SOC 1/2/3, ISO 27001, PCI DSS, and FedRAMP certifications. We use AWS services including EC2, RDS, S3, SES, VPC, CloudTrail, and GuardDuty.

Physical Security

We do not operate physical data centres. All physical infrastructure is managed by AWS, which maintains 24/7 physical security, biometric access controls, CCTV, and environmental controls at all facilities. Physical security audits are included in AWS's SOC 2 reports.

Availability Zones & Redundancy

All production services are deployed across a minimum of two AWS availability zones. Our database tier uses Multi-AZ RDS with automatic failover. We maintain a target RPO of 1 hour and an RTO of 4 hours for full service restoration following a region-level failure.

Separation of Environments

Production, staging, and development environments are fully isolated at the account level. No real customer data is used in non-production environments. Access to production is restricted and requires MFA, VPN, and approval from a second engineer.

4. Encryption

In Transit

All data transmitted between clients and Sendbound servers is encrypted using TLS 1.2 or higher. We enforce HTTP Strict Transport Security (HSTS) with a 1-year max-age and include our domain in the HSTS preload list. We support only strong cipher suites and have Perfect Forward Secrecy (PFS) enabled on all endpoints. TLS certificates are provisioned and rotated automatically.

Internal service-to-service communication within our infrastructure is also encrypted using mTLS.

At Rest

All customer data stored at rest is encrypted using AES-256. This includes database storage (AWS RDS encrypted volumes), object storage (AWS S3 with SSE-S3), backup files, and log archives. Encryption keys are managed via AWS Key Management Service (KMS) with key rotation enabled.

Email Content

Email content stored in Sendbound (for retry, analytics, and audit purposes) is encrypted at rest. We store the minimum data necessary and allow customers to configure retention periods or disable content logging entirely on Enterprise plans.

Secrets Management

Application secrets, API keys, and credentials are never stored in source code or environment configuration files. We use AWS Secrets Manager for production secrets, with automated rotation where supported by the downstream service.

5. Network Security

• VPC isolation — All production resources run inside a private AWS Virtual Private Cloud with no direct internet access. Only load balancers and bastion hosts are exposed to the public internet.
• Security groups — Strict ingress/egress rules on all EC2 instances and RDS clusters, following least-privilege principles. Default deny with explicit allowlist-only rules.
• DDoS protection — AWS Shield Standard is active on all public endpoints. We use Cloudflare as our DNS and CDN provider, which adds additional Layer 3/4/7 DDoS mitigation and Web Application Firewall (WAF) capabilities.
• WAF rules — Our WAF is configured to block OWASP Top 10 attack patterns, SQL injection, XSS, path traversal, and known malicious IP ranges.
• Intrusion detection — AWS GuardDuty is enabled in all regions and accounts, providing continuous threat detection based on CloudTrail, VPC Flow Logs, and DNS logs.
• Egress filtering — Outbound traffic from production systems is filtered to allowlisted destinations only. Unexpected outbound connections trigger automated alerts.

6. Application Security

Secure Development Lifecycle

Security is integrated into every stage of our development process. Engineers receive secure coding training annually. All code changes require peer review before merging. Security-sensitive changes require review by a designated security champion.

Static Analysis & Dependency Scanning

We run automated static analysis (SAST) on every pull request to detect common vulnerability patterns. All third-party dependencies are scanned for known CVEs on every build using automated composition analysis (SCA). Critical and high-severity vulnerabilities must be remediated before deployment.

OWASP Top 10

Our application security programme explicitly covers OWASP Top 10 vulnerabilities including injection, broken access control, cryptographic failures, security misconfiguration, and insecure deserialization. Controls are tested through code review, automated scanning, and annual penetration testing.

Rate Limiting & Abuse Prevention

All API endpoints are rate-limited per IP and per API key. Authentication endpoints have additional brute-force protections including exponential backoff, temporary lockout, and bot-detection (Cloudflare Turnstile). Anomalous usage patterns trigger automated alerts and temporary suspension.

7. Access Controls

Internal Access

Access to production systems follows least-privilege principles. Employees are granted access to the systems they need to perform their role — and nothing more. Access is reviewed quarterly and immediately revoked upon employee departure.

• All production access requires multi-factor authentication (MFA) and VPN
• Database access is via encrypted bastion host, logged, and audited
• Production console access requires peer approval and is time-limited
• All privileged actions are logged to an immutable audit trail in AWS CloudTrail

Customer Access Controls

Sendbound provides the following access controls to customers:

• API key scoping — keys can be restricted to specific IP ranges and API endpoints
• Team member roles — Owner, Admin, and Member roles with granular permissions
• SSO / SAML 2.0 — available on Enterprise plans (Okta, Azure AD, Google Workspace)
• Activity logs — full audit log of all user actions available to account owners
• Session management — configurable session timeouts and active session revocation

8. Personnel Security

• Background checks — All employees and contractors with access to production systems undergo background screening prior to start
• Security training — Annual mandatory security awareness training covering phishing, social engineering, password hygiene, and incident reporting
• Acceptable use policies — All employees sign and acknowledge our acceptable use, data handling, and confidentiality policies
• Offboarding — All access is revoked within 24 hours of employee departure; hardware is wiped and returned
• Need-to-know — Customer data is accessed by Sendbound employees only when necessary to provide support or investigate an incident, and only with the minimum scope required

9. Penetration Testing

Sendbound engages an independent third-party security firm to conduct a full penetration test at least once per year. Tests cover our web application, API, internal network, and cloud infrastructure. Our penetration testing programme includes:

• Black-box, grey-box, and white-box assessment methodologies
• OWASP Top 10 and SANS Top 25 vulnerability checks
• API security testing against OWASP API Security Top 10
• Infrastructure and cloud configuration review
• Social engineering resistance testing

All identified findings are triaged by severity (Critical / High / Medium / Low) and tracked to remediation. Critical and High findings must be remediated within 7 and 30 days respectively. Executive summaries of the most recent pen test are available to Enterprise customers under NDA.

10. Vulnerability Disclosure

We operate a responsible disclosure programme for security researchers. If you believe you have discovered a security vulnerability in Sendbound, please report it to us before public disclosure. We commit to:

• Acknowledging your report within 2 business days
• Providing an initial triage and severity assessment within 5 business days
• Keeping you informed of remediation progress
• Crediting researchers who responsibly disclose qualifying issues
• Not pursuing legal action against researchers acting in good faith

Please report vulnerabilities to security@sendbound.com using our PGP key (available on request). Include a description of the vulnerability, proof-of-concept steps, and the potential impact. Do not access or modify other customers' data during testing.

We operate a private bug bounty programme on HackerOne. If you are an active security researcher, contact us to request an invitation.

11. Incident Response

Sendbound maintains a formal Incident Response Plan (IRP) that is tested at least annually through tabletop exercises. Our process follows the NIST SP 800-61 framework:

• Detection & Triage — Automated alerts from GuardDuty, CloudTrail anomaly detection, and application monitoring feed into our 24/7 on-call rotation. All alerts are triaged within 15 minutes.
• Containment — Affected systems are isolated within minutes using automated runbooks. Production access is locked and scoped to the incident response team only.
• Eradication & Recovery — Root cause is identified, systems are cleaned or rebuilt from known-good snapshots, and controls are hardened before service restoration.
• Post-Incident Review — A detailed post-mortem is completed within 5 business days of every significant incident, with action items tracked to closure.

For Security Incidents affecting customer Personal Data, we will notify affected customers within 72 hours of becoming aware, as required by our DPA and applicable data protection law.

Our security team is reachable 24/7 for incident reporting at security@sendbound.com.

12. Availability & Backups

Uptime Target

Sendbound targets 99.9% uptime on all paid plans and 99.95% on Enterprise plans. Real-time status is available at status.sendbound.com. Historical uptime data is publicly accessible.

Backup Strategy

• Database: automated daily snapshots retained for 30 days, with point-in-time recovery enabled (5-minute granularity)
• Object storage: S3 versioning enabled with cross-region replication to a secondary AWS region
• Configuration: all infrastructure is defined as code (Terraform) and stored in version control
• Backups are tested via automated restoration drills quarterly

Disaster Recovery

Our disaster recovery plan is documented and tested at least annually. Recovery objectives: RPO of 1 hour, RTO of 4 hours. In the event of a full primary region failure, we can restore service in a secondary region using pre-provisioned infrastructure and replicated data.

13. Vendor & Supply Chain Risk

All third-party vendors with access to Sendbound systems or customer data undergo a security review before onboarding. Our vendor review process assesses:

• Security certifications (SOC 2, ISO 27001, or equivalent)
• Data processing agreements and DPA compliance
• Incident response and breach notification capabilities
• Access controls and credential management practices

Vendors are reviewed annually and upon significant changes to their service. Our subprocessor list is maintained and updated as described in our DPA.

14. Enterprise Security Controls

Enterprise plan customers have access to additional security features:

• SAML / SSO — Integrate with Okta, Azure AD, Google Workspace, or any SAML 2.0 provider. Enforce SSO for all team members.
• SCIM provisioning — Automate user provisioning and de-provisioning via SCIM 2.0, integrated with your IdP.
• Custom IP allowlisting — Restrict API and dashboard access to specific IP ranges or CIDR blocks.
• Audit logs — Full event-level audit log export via API or SIEM integration (Splunk, Datadog, Elastic).
• Custom data retention — Configure email content retention from 0 to 365 days, or disable storage entirely.
• Dedicated infrastructure — Isolated compute and database resources, available on request.
• Security review — On-request security review call with our security team, including Q&A and custom questionnaire completion.

Contact our sales team to discuss Enterprise security requirements: sales@sendbound.com

15. Contact the Security Team

For security enquiries, vulnerability reports, or to request security documentation:

• Security issues: security@sendbound.com
• Enterprise security reviews: security@sendbound.com — include "Enterprise Review" in the subject
• SOC 2 / pen test reports: Available under NDA to Enterprise customers
• Privacy / DPA: privacy@sendbound.com

We aim to respond to all security enquiries within 2 business days. For urgent incidents, include "URGENT" in the subject line.