EmailAudit Trust Center

Trust should be supported by evidence.

Review the safeguards already implemented in EmailAudit, the data involved in a scan, and the assurance work that remains before formal compliance claims are made.

Review controls Read privacy policy
Product controlsImplemented
Privacy documentationPublished
Independent assurancePlanned
Control register

Safeguards visible in the product

These statements describe current application behavior—not aspirational certifications.

Identity and access

  • Scrypt password hashing
  • Hashed session tokens in HTTP-only, same-site cookies
  • Workspace-bound owner, admin, analyst, and viewer roles
  • Hashed API credentials with explicit scopes

Data and secrets

  • Public-data-first domain diagnostics
  • AES-256-GCM protection for stored webhook signing secrets
  • Plan-based scan-history retention
  • Domain removal and permanent account-deletion workflows

Application and network

  • Content Security Policy and browser security headers
  • Bounded and schema-validated input
  • Rate limits on public and sensitive operations
  • Private-network blocking for outbound HTTPS and webhook destinations

Operations and monitoring

  • Workspace audit events for sensitive changes
  • Versioned database migrations
  • Bounded background-job retries and failure status
  • Signed webhook delivery with timestamped HMAC-SHA256 signatures
Public documents

Start a vendor review here

Everything listed below is available without inventing an audit, report, or certification.

Security architectureImplemented controls and launch responsibilities
Privacy policyData categories, purposes, retention, and deletion
Terms of serviceService boundaries and acceptable use
System readinessLive configuration status for provider-backed features
Assurance roadmap

What must happen before stronger claims

  1. 01Production foundationsManaged encrypted backups, restore testing, centralized secrets, dependency scanning, and external uptime monitoring.
  2. 02Operational programNamed incident-response ownership, logging retention, access reviews, vendor review, and security awareness processes.
  3. 03Independent validationQualified penetration testing and a scoped compliance-readiness assessment before publishing formal assurance claims.
About scan data

The free Email Domain Health Check evaluates a domain’s public DNS, certificates, HTTPS, mail infrastructure, and reputation signals. It does not inspect individual mailboxes, request mailbox credentials, or access private customer data.