MAILRAFT / PRODUCT

Trust center

A single page that answers the questions auditors, procurement teams and partners ask most often. Everything linked here is maintained alongside the product.

Infrastructure

• Primary hosting: self-managed by Bisso Technologies Ltd on a dedicated VPS.
• Edge: Cloudflare DNS and TLS termination for public hostnames.
• Email outbound: Amazon SES (eu-north-1).
• Email inbound: Google Workspace OAuth readonly; Microsoft 365 roadmap.
• Database: dedicated self-hosted Postgres with RLS enforced.

Data residency

• Application and database: owner-controlled VPS.
• SES processing: AWS Europe (Stockholm) eu-north-1.
• Google OAuth: global, scoped to the tenant you connect.

Compliance posture

• Primary regulatory anchor: Tanzania Personal Data Protection Act 2022.
• Applicable recipient and privacy requirements must be assessed for each use case; this page does not claim blanket legal compliance.
• Security controls receive scoped source review and local tests. No independent certification or SOC 2 attestation is claimed.

Security practices

• Multi-tenant isolation with RLS.
• Encrypted integration credentials with per-tenant keys.
• SSRF-safe outbound HTTP gateway.
• Signed webhook verification with constant-time comparison.
• Build artifacts carry an immutable release SHA used in deploy evidence.

Change management

• Each release records sanitized evidence under the Evidence Envelope v1 schema.
• Live boundary gate (pnpm verify:live) runs against production on every release.
• Database migration history is additive and forward-only; destructive operations require explicit owner approval.

Business continuity

• Encrypted off-site backup and readback have prior scoped evidence. Retention and current restore readiness require operator verification; independent off-host restore remains unverified.
• Documented rollback: previous immutable release plus database restore path.
• Status page: https://status.mailraft.com.

Vendor management

• Each sub-processor is scoped to a specific role and reviewed before activation.
• Vendor list is published in the Privacy policy.

Documents on request

• Data Processing Agreement template.
• Standard subprocessor list.
• Security questionnaire (SIG Lite style).
• Pentest summary once published.

Contact

• contact@mailraft.com for security questions and disclosures.
• contact@mailraft.com for data processing and compliance questions.
• contact@mailraft.com for commercial trust and procurement.