Security is a core value at Rainmail, not an afterthought. Businesses trust us with their contact lists, their message content, and their mailboxes — so we protect that information with the same discipline a much larger company would, and we are honest about exactly where we stand.
ISO/IEC 27001:2022 status. Rainmail operates a full ISO/IEC 27001:2022–aligned Information Security Management System (ISMS) — documented scope, a complete Statement of Applicability across all 93 Annex A controls, and a maintained risk register. We are audit-ready and pursuing formal certification with an accredited certification body. We do not describe Rainmail as “certified” until that certificate is issued — because only an accredited body can grant it, and honesty is part of how we earn your trust.
All traffic is encrypted in transit with TLS (HTTPS for the app, STARTTLS for mail). Backups are encrypted at rest with AES-256. Passwords are stored using bcrypt hashing, and secrets and signing keys are held with strict, root-only file permissions — never exposed to the browser or to logs.
Losing a customer’s mail is unacceptable to us. Every night we take an encrypted, integrity-tested snapshot of all mailboxes, configuration, and signing keys, and push a copy off-provider to separate cloud storage — a different provider than the one running our servers, so no single vendor is a single point of failure. Restores are verified, and disaster recovery is automated: a fresh server can be rebuilt from the encrypted cloud backup with a single command.
Each customer account can access only its own domains, mailboxes, and lists. Sending is isolated across dedicated network lanes so that one sender can never damage another’s deliverability, and our own brands are walled off from customer traffic. If a sending IP is ever affected, we can swap it without touching everyone else.
Administrative access to our infrastructure uses SSH keys only — no password logins. Customer accounts support multi-factor authentication (time-based one-time passwords with recovery codes). Access follows the principle of least privilege, and API tokens are scoped as narrowly as possible.
We run continuous monitoring (metrics, alerting, and uptime probes) and a daily reputation and blocklist sweep across major deny-lists. Security events are detected automatically and follow a defined incident-response process: detect, contain, eradicate, recover, and learn — where every incident becomes a new automated safeguard.
Every domain you send from is authenticated with SPF, DKIM, and DMARC, and each message is DKIM-signed. This protects your recipients from spoofing and protects your sender reputation.
Rainmail stores no payment-card data. Card payments are handled entirely by our PCI-DSS-compliant payment processor through hosted checkout, so sensitive card details never touch our systems.
For the recipient data you send through Rainmail, you are the data controller and Rainmail acts as your processor, under our published Data Processing Agreement. We support GDPR and CCPA obligations, honor data-subject and unsubscribe requests, and never sell your data or mine the contents of your mailboxes. See our Privacy Policy, Terms, and Acceptable Use Policy.
Enterprise customers and partners can request our Statement of Applicability, security policies, and answers to a vendor security questionnaire under NDA. Contact security@getrainmail.com or support@getrainmail.com.
If you believe you have found a security issue, please email security@getrainmail.com. We take every report seriously and will respond promptly.