How We Handle Your Data
You are handing us contact data and mailbox access. This page says exactly what we do with both, which controls are audited, and who else touches it.
Controls In Place
What a reviewer usually asks for, answered without a call.
Encryption
AES-256 at rest on all stores including backups. TLS 1.3 in transit. Mailbox tokens are held in a separate encrypted vault with its own key rotation.
Access control
Least privilege internally, SSO enforced for all staff, hardware keys required for production access, and every session logged.
Data residency
Pick EU or US per workspace at creation. Data does not leave the chosen region, including backups and log aggregation.
Retention
Contacts kept until you delete them. Rejected import rows purge after 30 days. Closed accounts are fully erased within 60 days.
Mailbox scope
We request send and read-reply scopes only. We do not read your existing inbox, archive or calendar, and the OAuth consent screen shows this.
Incident response
Documented runbook, 24-hour customer notification commitment for confirmed breaches affecting your data, and a public status page.
Sub-Processors
Everyone who touches customer data, and why. We give 30 days' notice before adding to this list.
Security Questions
And how to reach us about them.
Can I get the SOC 2 report?
Yes, under NDA, along with the latest penetration test summary. Email support@outfrank.com and it is usually with you the same day.
Do you train models on my data?
No. Customer contact data and email content are never used to train any model, ours or a third party's. There is no opt-out because there is nothing to opt out of.
How do I report a vulnerability?
support@outfrank.com, PGP key on request. We acknowledge within one working day and we do not threaten researchers who act in good faith.
What happens if I close my account?
Export everything first — it stays available for 30 days. After 60 days all data including backups is irreversibly deleted, and we confirm in writing.
Start Sending With Outfrank
Import a list, connect an inbox, and send your first campaign today. No credit card, no sales call.