Security you can verify,
not just trust.
GlockApps helps you test and improve email deliverability. Here's exactly what we collect, how we protect it and how long we keep it — in plain language, no legalese required.
Google CASA 2026: In Compliance · Last updated: 8 October 2026
- Google CASA Verified · 2026
- AES-256 & TLS 1.2+ Encryption
- OAuth For Gmail, Outlook & Mailchimp
- SMTP Passwords Double-Encrypted
- No Card Data Stored
- Argon2id & Two-Factor Login
- Hosted On AWS
What protects your data
The essentials at a glance. Full detail lives in our policies, available on request.
Tested by an App Defense Alliance lab — not by us.
Independent assessment
Manual grey-box testing plus Burp Suite scanning of our web app and Gmail integration, against Google's CASA requirements built on OWASP ASVS.
Verdict: In Compliance · Assessor: TAC Security · Tested: 13 Aug 2026 · Report issued: 22 Sep 2026 · 21 / 21 control groups passed
Encryption
- AES-256 at rest — databases, storage and backups
- Extra encryption for the SMTP and proxy credentials you add
- TLS 1.2+ only, HSTS preload; older TLS disabled
- Encryption keys managed by AWS, every access logged
Sign-in & sessions
- Argon2id password hashing with salt and pepper
- 2FA with any TOTP authenticator app
- Brute-force lockout after 10 failed attempts
- Session control — see every device, sign any out
Team & access
- Roles — admin, writer or read-only
- OAuth 2.0 for Gmail, Outlook, Mailchimp, Klaviyo & HubSpot
- Staff access least-privilege, MFA-only, reviewed quarterly
- Our people sign NDAs, get security training; access revoked on exit
Infrastructure
- AWS us-east-1 — data and backups stored in one region
- Private network; only HTTPS exposed, behind a WAF
- 99.95% uptime target across multiple availability zones
- Daily backups; service restored within 24 hours (RPO / RTO 24 h)
Your data
- Minimal personal data — essentially name and email
- Auto-deleted on a fixed schedule — see the table
- No card data — payments go to a PCI-compliant processor
- Never sold; account deletion on request within 14 business days
Incidents & privacy
- Breach notice without undue delay — no later than 72 hours after confirmation, as GDPR requires
- Fixes by severity: critical 72 h, high 7 days, medium 30 days, low 90 days
- Post-incident review within 10 business days of containment
- GDPR & CCPA aligned, DPA available
Where we are, and what's next
We only list an assessment as done once an independent party has signed it. Everything else is marked as planned.
In compliance · 2026
Google CASA
Assessed by TAC Security · Sep 2026 · first passed Dec 2024
Aligned
GDPR & CCPA
Incl. UK & Swiss GDPR · DPA for every customer
Scheduled · 2027
Penetration test
Independent web-app & API test with Letter of Attestation
Planned
SOC 2 Type 2
Independent audit of controls over time
Planned
ISO/IEC 27001
Certified security management system
The straight answer
We don't hold our own SOC 2 report or ISO 27001 certificate yet — both are on our roadmap. Here's why that rarely blocks a review:
- Little sensitive data. We store your name and email, the test messages you choose to send to our seed addresses, and deliverability results. No payment cards, no health or financial records.
- Certified infrastructure. Everything runs on AWS, which holds SOC 1/2/3 and ISO 27001 for the data centres, servers and storage underneath GlockApps.
- Outside your mail flow. GlockApps tests and monitors. We never email your real customers — test campaigns go only to our seed addresses.
- Independently tested in 2026. Our app passed Google's CASA assessment by TAC Security, built on the OWASP security standard.
Everything your security review needs
Our assessment report and security policies are confidential and shared under NDA. Legal documents — Terms, Privacy, DPA and more — are linked in the footer.
Secure, time-limited link within 5 business days
What we collect, and how long we keep it
We keep a deliberately small data footprint. We don't sell your data, we never see your card details, and test data is deleted on a fixed schedule.
What we collect & how long we keep it
| Data | What’s included | Retention |
|---|---|---|
| Account | Name, email, username, SMTP/IMAP settings & OAuth connections | until you delete your account |
| Inbox tests | Test messages & placement results | 12 months |
| Message headers | Headers of your test messages | 30 days |
| Spam checker (free) | Report on the message you check | 30 days |
| DMARC | Aggregate reports for your domains | 180 days paid · 30 days free |
| Raw DMARC XML | Original report files | 30 days |
| Uptime Monitor | Checks & status history | 90 days |
| Sender Score | IP reputation history | 30 days |
| Technical data | IP address, browser, OS, sign-in & server logs | 90 days |
| Account activity log | Actions taken in your account | while your account is active |
| Billing | Card & billing details | never stored — handled by our payment processor |
| Free accounts with no activity | No dashboard login and no API requests | may be deleted after 12 months |
| Your account, on request | Account and all related data | deleted within 14 business days |
Core sub-processors
The established providers that run the GlockApps service itself.
| Provider | Purpose |
|---|---|
| Amazon Web Services | Hosting, storage and backups |
| Verifone (2Checkout) | Payment processing |
| Mailgun | Account and report emails |
| Zendesk | Customer support |
Other tools we use, for example for marketing and website analytics, receive only minimal, non-sensitive data. The full list is available on request from security@glock-apps.com.
Questions security teams ask us most
Questions this page doesn't answer?
Talk to our security team directly: security@glock-apps.com. Found a vulnerability? Report it privately to the same address — we acknowledge within 5 business days and won't take action against good-faith research.
