Company and service
| Ref | Question | Answer |
|---|---|---|
| C1 | Who provides the service? | N/A Mailfois is a trading name of WealthR Ltd, a company registered in Scotland (SC900929), registered office 5 South Charlotte Street, Edinburgh, EH2 4AN. Contact: [email protected]; security: [email protected]. |
| C2 | What does the service do? | N/A Mailfois is a web app where email teams and agencies plan campaigns, mock up and check emails, translate copy, get emails signed off and keep an archive of what was approved. It works alongside an email service provider (ESP) and does not send marketing email. |
| C3 | How large is the company, and who can access production? | N/A Mailfois is a small company run by its founder. Access to production systems is limited to the people who run Mailfois and protected with multi-factor authentication. |
| C4 | Do you have a named security contact and a disclosure process? | Yes Yes: [email protected], published in /.well-known/security.txt. We acknowledge reports within two working days and keep the reporter updated. |
Data we hold, and data we never hold
| Ref | Question | Answer |
|---|---|---|
| D1 | Does Mailfois store subscriber, customer or mailing lists? | No No. Mailfois never imports or stores subscriber, customer or mailing lists, and our DPA tells customers not to upload them. |
| D2 | Does Mailfois connect to our ESP or store ESP credentials or API keys? | No No. Emails come into Mailfois as a preview (view-in-browser) link or pasted HTML. There is no ESP connection and no ESP credentials are stored. |
| D3 | Does Mailfois send email to our customers? | No No. Mailfois never sends campaigns. It sends only account email (sign-in, invitations, notifications, approval links and reminders) to the people using it. "Send me a test" goes only to the signed-in user's own address, at most 10 an hour. |
| D4 | What personal data does Mailfois process? | N/A Names, work email addresses, job titles and roles of your users and the approvers you invite; comments, approvals and activity history; and any personal data that happens to be in content you upload (for example a test address left in an email's HTML). |
| D5 | Is email performance data stored per recipient? | No No. Results are stored as totals per email (sent, opens, clicks, orders, revenue, unsubscribes), optionally per market. Nothing per person. |
| D6 | Can customer replies be uploaded, and how are they protected? | Yes Optionally, to see what customers said. Email addresses, phone numbers, postcodes, order numbers, links, quoted messages, signatures and the names in greetings and sign-offs are stripped in the browser before anything is saved, and again on the server. Mailfois has no inbox that receives customer replies. |
| D7 | Is special category data processed? | No None is intended. Our DPA asks customers not to upload special category data without agreeing safeguards with us first. |
| D8 | Is customer content used to train AI models? | No No. The only AI feature is optional alt text for images, off until a user asks for it on a particular image. That image is sent to Anthropic's API, which does not train on API data under its commercial terms. |
Hosting, location and sub-processors
| Ref | Question | Answer |
|---|---|---|
| H1 | Where is our data stored? | UK In the United Kingdom: our database, file storage and authentication provider (Supabase) runs in its London region. The app is served from Cloudflare's global network. |
| H2 | Which sub-processors do you use? | Listed Supabase (database, files, authentication; UK), Cloudflare (hosting, delivery, security, email routing; global), Resend (account email; US), Anthropic (optional alt text; US) and Stripe (billing; EU, UK, US). The list is Annex 3 of our DPA at mailfois.com/dpa. |
| H3 | Will you tell us about sub-processor changes? | Yes Yes, by email to the workspace owner at least 30 days before adding or replacing one, with a right to object (DPA section 6). |
| H4 | Does Mailfois send data to other tools, such as Teams or Slack? | No Not unless you ask it to. Only if a workspace owner or admin connects their own Microsoft Teams or Slack channel. Then Mailfois posts short messages there (which email, what happened, who did it, and a link back), never customer data. The channel belongs to you, so Microsoft or Slack handle those messages for you under your own agreement with them; they are not our sub-processors. Only Slack and Microsoft webhook addresses are accepted, only owners and admins can see them, and connecting or removing one is recorded in the activity log. |
| H4 | How are international transfers covered? | Covered Through UK adequacy regulations (including the UK-US Data Bridge where the recipient is certified), the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable (DPA section 10). |
Encryption
| Ref | Question | Answer |
|---|---|---|
| E1 | Is data encrypted in transit? | Yes Yes. Every connection uses TLS, and browsers are told to use HTTPS only (HSTS, one year, including subdomains). |
| E2 | Is data encrypted at rest? | Yes Yes, by our database and hosting providers (Supabase encrypts data at rest with AES-256). |
| E3 | How are secrets and keys managed? | Yes Server keys are held as encrypted secrets with our hosting provider, never in source code or the browser. |
| E4 | How are private links (approval, translator, share links) protected? | Yes Each carries a random code with 256 bits of randomness, and only a one-way hash is stored, so links can't be recovered from our database. Links can be switched off or replaced at any time; approval links expire 30 days after approval and have a "This isn't me" button that switches the link off and alerts the team. Share links can also have a password. |
Access control and identity
| Ref | Question | Answer |
|---|---|---|
| A1 | How is access between customers separated? | Yes Every database table uses row-level security, so people can only read and change data in workspaces they belong to. The rule is enforced by the database itself, not only by the app. Each agency client has its own separate workspace. |
| A2 | Can we control roles and what each person sees? | Yes Yes. Owners and admins manage membership and roles (owner, admin, member), tag builders and approvers, and can hide areas from individual members. Agencies choose which staff can open each client. |
| A3 | Is multi-factor authentication available, and can we require it? | Yes Yes. Two-factor sign-in with an authenticator app (TOTP), with backup devices. Workspace owners and admins can require it for everyone in the workspace, and the requirement is held in the database too: without it, the workspace's data can't be read at all. |
| A4 | Is single sign-on (SAML/SSO) supported? | Not yet Not yet. Sign-in with Microsoft (Entra ID) and Google accounts, with a workspace rule that requires it, is built and being switched on. SAML single sign-on (for example through Okta or Entra ID) is set up on request; tell us if you need it to start. |
| A5 | Is user provisioning (SCIM) supported? | Not yet Not yet. Users are invited by email by an owner or admin, or requested by a member and approved by an admin. |
| A6 | What is the password policy? | Yes At least 10 characters (a passphrase is encouraged). Passwords are stored hashed by our authentication provider, never by us in plain text. |
| A7 | How are sessions protected? | Yes Secure, HTTP-only cookies. Users can choose not to stay signed in on a shared computer. |
| A8 | Do external approvers need accounts? | No No. Outside approvers use a private link that shows only what was sent to them. Translator links can have a password, limited to 5 tries every 15 minutes. |
| A9 | How do you remove access when someone leaves? | Yes Owners and admins remove members at once. Private links can be switched off or replaced at any time. |
| A10 | Can we limit who can be invited? | Yes Yes. Owners and admins can list the email domains that may join (for example brand.com); invites to any other address are refused by the database. |
Application security
| Ref | Question | Answer |
|---|---|---|
| S1 | What security headers do you set? | Yes HSTS, X-Content-Type-Options nosniff, a strict Referrer-Policy, a Permissions-Policy, and a Content-Security-Policy that forbids framing the app, plugins and base-tag changes, and only runs scripts from Mailfois itself (each page's scripts carry a one-time nonce) and Cloudflare's privacy-friendly analytics. No code is loaded from any other site. |
| S2 | How do you handle email HTML that customers upload? | Yes Before an email is shown, its scripts, event handlers and javascript: links are removed and a script-blocking Content-Security-Policy is added. |
| S3 | Is the link checker safe to run on tracked links? | Yes Yes. Tracked ESP links are decoded and never opened, so no click is recorded, and unsubscribe links are never opened. |
| S4 | Are uploaded files private? | Partly Team documents and support screenshots are kept in private storage and opened through signed links that expire. The one exception is the team's image library for mock-ups: those pictures sit at long, unguessable public addresses so they show inside mock-ups and sign-off previews. Only members of the workspace can add, list or delete them. Don't put anything confidential in it. |
| S5 | How do you manage vulnerabilities in dependencies? | Yes We review our providers' security advisories and keep dependencies up to date. |
| S6 | Has the service had an independent penetration test? | Not yet Not yet. We'll share the summary once one is done. In the meantime we're happy to answer detailed questions, and we welcome reports through [email protected]. |
| S7 | Do the free tools upload our content? | No The free pre-send tools and the image tool run in the browser. Content isn't uploaded unless a user chooses a feature that needs it, such as AI alt text. |
| S8 | Are database functions locked down? | Yes Yes. Functions that aren't part of a private link (approval, translator, share) can't be called by anyone who isn't signed in, those that answer workspace questions answer only for your own workspace, and the scheduled reminder jobs run only with our server key. Reviewed on 18 October 2026. |
Audit trail and records
| Ref | Question | Answer |
|---|---|---|
| L1 | Is there an audit trail of approvals? | Yes Yes. Every submission, approval, change request, reopening and scheduled send is recorded with who, when and which version, and can be printed as an approval record. |
| L2 | Is there a history of changes to plans? | Yes Yes. Changes to campaigns (dates, people, status, markets, links) are recorded automatically and shown in History, grouped by email. |
| L3 | Are approved versions kept? | Yes Yes. Every version of an email in sign-off is kept, can be compared, and the approved email is archived in the Library as it was approved. |
| L4 | Is there a log of changes to users, access and security settings? | Yes Yes. Owners and admins see who changed what at Settings, then Activity: people joining, leaving or changing role, invites, area access, two-factor, sign-in and domain rules, other settings, plan changes and data exports, with a CSV download. It also shows when each person last signed in and how. |
Incidents, backups and continuity
| Ref | Question | Answer |
|---|---|---|
| I1 | Will you tell us about a personal data breach? | Yes Yes, without undue delay and in any event within 48 hours of becoming aware of it, with the details needed for your own obligations (DPA section 8). |
| I2 | Are backups taken? | Yes Yes. Our database provider takes daily backups, which we can restore from. In the worst case, up to a day of changes could be lost (recovery point up to 24 hours). |
| I3 | Can we export our data? | Yes Yes. Owners and admins can download a full workspace export (JSON, including links to every document) at any time, plus printable approval records and reports. |
| I4 | What happens to our data when we leave? | Yes A closed workspace's data is deleted within 30 days, unless the law requires us to keep it. Copies in backups are overwritten on their normal cycle and stay protected until they are (DPA section 11). Agencies can instead hand a client's workspace over to the client. |
| I5 | What happens if Mailfois closes? | Yes Our terms commit us to email every workspace owner at least 90 days before closing. Everything keeps working and can be exported until then, and prepaid time beyond the closing date is refunded. If something outside our control forced an earlier closure, we'd give as much notice as we could and keep data available to export for as long as we were able. |
| I6 | Do you have a formal business continuity plan and uptime SLA? | Not yet Not yet. The service runs on Cloudflare and Supabase's managed infrastructure, data can be exported at any time, and the 90-day closure notice above is in our terms. Ask us if you need specific commitments. |
Privacy and compliance
| Ref | Question | Answer |
|---|---|---|
| P1 | Do you offer a data processing agreement? | Yes Yes, at mailfois.com/dpa. It forms part of our terms automatically, and we'll countersign a copy on request. |
| P2 | Which privacy laws does it cover? | Yes The UK GDPR and Data Protection Act 2018, the EU GDPR where relevant, US state laws such as the CCPA (as a service provider), Canada's PIPEDA and Australia's Privacy Act. |
| P3 | Will you help with data subject requests and DPIAs? | Yes Yes. Most requests can be handled in the product (export, correct, delete). We pass on any request we receive directly and give reasonable help with impact assessments (DPA sections 7 and 9). |
| P4 | Can we audit you? | Yes We answer security questionnaires, and if that isn't enough you may audit once a year on 30 days' notice, at your cost and under confidentiality (DPA section 12). |
| P5 | Do you hold SOC 2 or ISO 27001 certification? | No Not Mailfois itself, yet. Our main infrastructure providers publish their own reports and certifications: see Supabase's and Cloudflare's security and trust pages. Card payments are handled by Stripe and never touch our servers. |
| P6 | How are payments handled? | Yes By Stripe. Card details go straight to Stripe and never reach our servers. |
Something not covered?
Send your questionnaire to [email protected] and we'll fill it in. For how we protect data day to day, see the security page.